Hawaii Joins $2,287,455 Labcorp Data Breach Settlement With 43 Other States — No Consumer Claim Form

Hawaii has joined 43 other states and the District of Columbia in a $2,287,455 multistate settlement with Laboratory Corporation of America Holdings (Labcorp) over a 2019 data breach involving its former debt-collection vendor, American Medical Collection Agency (AMCA).

The amount is $2,287,455, about $2.3 million. The agreement does not create a new consumer settlement fund or a claim process. Labcorp’s payment goes to the participating attorneys general, and the agreement requires Labcorp to strengthen how it protects patient information and oversees vendors that handle sensitive data.

The settlement is documented in an Assurance of Voluntary Compliance, Assurance No. 26-053, signed by Labcorp and the participating attorneys general, with an effective date of October 1, 2026.

Is There a Claim Form?

No. There is no claim form, consumer payout or claims deadline under this $2,287,455 multistate settlement. Hawaiʻi residents affected by the old AMCA breach cannot file a claim for this agreement.

Looking for the consumer class action instead? See our coverage of the Labcorp AMCA Data Breach $35M Settlement, File By Sept. 3, 2026.

Labcorp Data Breach Settlement Quick Facts

Detail	Information
Company	Laboratory Corporation of America Holdings (Labcorp)
Debt-collection vendor	Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA)
Settlement amount	$2,287,455
Participating jurisdictions	44, including Hawaiʻi and the District of Columbia
Hawaiʻi participation	Hawaiʻi Attorney General and Hawaiʻi Office of Consumer Protection
Breach announced	June 2019
Labcorp patients potentially affected	Approximately 10.2 million
People potentially exposed through AMCA	More than 27.5 million
Settlement document	Assurance of Voluntary Compliance No. 26-053
Effective date	October 1, 2026
Consumer claim form	None
Consumer payout	None
Federal court case number	Not applicable to this multistate enforcement settlement
Related federal class action	In re American Medical Collection Agency, Inc., Customer Data Security Breach Litigation, No. 19-md-2904 (D.N.J.)

Why Did Labcorp Reach the Multistate Settlement?

The settlement concerns a 2019 data breach at Retrieval-Masters Creditors Bureau, doing business as AMCA, a debt-collection vendor used by Labcorp. The settlement document says Labcorp first contracted with AMCA in 1996 and that the breach was publicly announced in June 2019.

According to the document, approximately 10.2 million Labcorp patients were notified that an unauthorized person or persons potentially gained access to certain AMCA systems. The wider AMCA incident potentially exposed personal information of more than 27.5 million people nationwide. State releases about the breach identify sensitive information such as Social Security numbers, payment-card information and medical-test information.

State attorneys general investigated whether Labcorp adequately protected information it gave to its vendor and whether its vendor-management practices were sufficient. The Assurance resolves claims under state consumer-protection laws, state personal-information protection laws, state breach-notification laws and HIPAA-related claims identified in the agreement.

The agreement was reached without a trial, adjudication or finding of liability.

Related article: New Jersey Appeals Panel Questions Attorney’s Authority Over $600,000 Injury Settlement

What the Settlement Requires Labcorp to Change

The $2,287,455 payment is only one part of the agreement. Labcorp must:

• maintain and update its information-security program and designate a qualified information-security executive to oversee it;
• maintain an incident-response plan covering security events involving vendors; and
• limit disclosures of protected health information to vendors to what is necessary for the intended purpose, consistent with the HIPAA minimum-necessary standard.

How Labcorp Must Monitor Debt Collectors

Under the settlement, Labcorp must maintain a vendor-risk-management program covering companies that handle consumer and protected health information. For debt collectors, the requirements include:

• a contract inventory identifying the types of information each debt collector holds or processes, and each vendor’s risk rating;
• contractual cybersecurity requirements, including data segmentation, appropriate data disposal, vulnerability remediation, annual risk assessments and penetration testing;
• certain external security audits, such as annual SOC 2 Type 2 audits or qualifying alternatives; and
• contractual rights to act against a non-compliant debt collector, including terminating the contract.

Labcorp has up to 12 months after the October 1, 2026 effective date to amend existing debt-collector contracts where necessary.

What the $2,287,455 Payment Means for Consumers

The $2,287,455 is not a settlement fund for consumers. The Assurance requires Labcorp to pay the total amount to the participating attorneys general and does not create individual payments for people whose information was exposed.

The agreement also preserves private rights of action. The multistate release does not itself eliminate private legal rights that consumers may have. A government enforcement settlement and a consumer class action are separate legal mechanisms.

Is There a Labcorp Data Breach Claim Form?

No. Do not enter personal information into any website claiming to process a claim for this multistate settlement. The payment goes to the participating government entities, not to people affected by the AMCA breach.

If you received a Labcorp or AMCA breach notice, keep it and any related records, since they may be relevant to separate legal proceedings over the 2019 breach.

The Separate $35 Million Labcorp Class Action

The multistate settlement is separate from the federal consumer litigation, In re American Medical Collection Agency, Inc., Customer Data Security Breach Litigation, No. 19-md-2904, in the U.S. District Court for the District of New Jersey.

Labcorp separately agreed to a $35,000,000 settlement in that related class action, according to the state attorneys general announcing the 2026 multistate agreement. The claim deadline for that consumer settlement was September 3, 2026, which has already passed. See our earlier coverage below for details.

Do not confuse that consumer class settlement with the new $2,287,455 government settlement.

What Hawaiʻi Residents Should Do

• If your question concerns the 2026 multistate settlement: there is no claim to submit and no payment to request.
• If your question concerns the separate federal AMCA class action: that proceeding has its own court documents, terms and deadlines, and the claim deadline has passed.
• Be cautious of scams: be wary of unsolicited emails, texts or websites asking for Social Security numbers, banking details or payment in exchange for access to a supposed Labcorp settlement.
• Use official resources: the Hawaiʻi Office of Consumer Protection provides consumer-protection resources and information about reported security breaches affecting Hawaiʻi residents.

What Happens Next

The Assurance takes effect on October 1, 2026, and Labcorp must begin implementing the required security and vendor-management measures. Within 18 months after the effective date, Labcorp must obtain an independent third-party assessment of its compliance, with a formal report prepared for the Connecticut Attorney General’s Office. Participating attorneys general may obtain the report, subject to applicable public-records rules. The specified vendor-security obligations last for five years after the effective date.

Taxes and Attorney Fees: General Information

Taxes. The $2,287,455 goes to state governments, so it has no direct tax effect on individual consumers. For payments from the separate class settlement, tax treatment can depend on what the payment compensates. Consult a tax professional about your own situation.

Attorney fees. This settlement is an enforcement agreement between Labcorp and the attorneys general, and it does not create a consumer fund from which private class-action fees would be deducted. Fee terms in the separate class action are set out in that settlement’s own documents.

Key Dates

Event	Date
Labcorp publicly announced the breach	June 4, 2019
Labcorp signed the Assurance	September 18, 2026
Multistate settlement announced by attorneys general	September 24, 2026
Effective date	October 1, 2026
Labcorp payment deadline	Within 30 days of the effective date, subject to required state approval
Third-party compliance assessment	Within 18 months after October 1, 2026
Vendor-security obligations end	Five years after the effective date

Frequently Asked Questions

Do Hawaiʻi consumers get money from the $2,287,455 Labcorp settlement?

No. The payment goes to the participating attorneys general. The Assurance does not create individual consumer payments.

Is the Labcorp settlement $2.3 billion?

No. The exact amount is $2,287,455, about $2.3 million, not $2.3 billion.

Does the settlement have a claim form?

No. It has no claim form, consumer fund or individual payout.

Is this a class action?

No. The 2026 multistate settlement is an enforcement settlement between Labcorp and participating attorneys general. A separate federal class action over the AMCA breach is In re American Medical Collection Agency, Inc., Customer Data Security Breach Litigation, No. 19-md-2904.

What information was involved in the breach?

About 10.2 million Labcorp patients were notified that an unauthorized person or persons potentially accessed certain AMCA systems. State releases identify sensitive information such as Social Security numbers, payment-card information and medical-test information.

Is Assurance No. 26-053 a federal court case?

No. It is an Assurance of Voluntary Compliance between Labcorp and the participating attorneys general, and it does not identify a federal court case number.

Does the settlement stop consumers from bringing private claims?

No. The Assurance states that it does not waive or limit private rights of action. Whether you have a viable claim depends on the facts and applicable law.

Related AllAboutLawyer Coverage

Labcorp AMCA Data Breach $35M Settlement, File By Sept. 3, 2026 covers the separate $35 million consumer class-action settlement over the same Labcorp/AMCA breach.

Sources

1. Assurance of Voluntary Compliance No. 26-053, Laboratory Corporation of America Holdings and participating attorneys general
2. New York Attorney General, September 24, 2026, announcement of the $2,287,455 multistate Labcorp settlement
3. Delaware Department of Justice, September 24, 2026, announcement of the 44-attorney-general settlement
4. West Virginia Attorney General, September 24, 2026, announcement of the Labcorp data breach settlement

About the Author

Israr Ahmad is a legal content researcher covering U.S. lawsuits, settlements and court records, explaining legal developments in plain English using public filings and government records.

Disclaimer: This article is for informational purposes only and is not legal advice and does not create an attorney-client relationship. Settlement terms, legal rights and available remedies depend on the specific facts and applicable law.