CHARLESTON, W.Va. — West Virginia Attorney General JB McCuskey announced Thursday that the state has joined a coalition of 44 attorneys general in a $2.3 million multistate settlement with Laboratory Corporation of America (Labcorp). The agreement resolves an investigation into a 2019 data breach involving Labcorp’s debt collector, Retrieval-Masters Creditors Bureau, operating as American Medical Collection Agency (AMCA).
The breach exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients. In West Virginia alone, the incident impacted more than 145,000 consumers.
Although the breach occurred at AMCA, investigators emphasized that the compromised data belonged to Labcorp patients — and that companies cannot outsource responsibility for protecting sensitive information. Under HIPAA, covered entities must safeguard personal and health data and ensure vendors meet security standards.
“One of the biggest responsibilities companies have — especially companies that have access to our personal identifiable information — is to keep that information secure,” McCuskey said. “Labcorp and the AMCA did not live up to the trust we put in them. By holding them accountable, we are putting all companies on notice: they must keep patients’ and clients’ personal information secure.”
Under the settlement, Labcorp must strengthen vendor oversight and data‑security practices, including:
- Enhancing incident‑response plans to ensure internal reporting of vendor security events;
- Minimizing data shared with vendors while meeting legal obligations;
- Expanding vendor risk‑management programs with dedicated staff, evaluation tools, and compliance checks;
- Adding debt‑collector‑specific requirements such as contract inventories, cybersecurity standards, data segmentation, audits, and termination rights;
- Hiring a third‑party assessor to review information‑security systems with a focus on vendor risk.
Labcorp will pay $2,287,455 to participating states, with $34,023 allocated to West Virginia. The settlement supplements a 2021 multistate agreement with AMCA, which included a $21 million suspended payment due to the company’s bankruptcy. Labcorp also agreed to a $35 million settlement in a related class‑action lawsuit.
The investigation was led by attorneys general from Connecticut, Florida, Indiana, Illinois, Michigan, and Texas, with support from West Virginia and several other states.
