Labcorp’s $2,287,455 Settlement With 44 Attorneys General Over the AMCA Data Breach, What It Requires, Whether Patients Can Claim and How It Differs From the $35 Million Settlement

Laboratory Corporation of America Holdings, known as Labcorp, agreed to pay $2,287,455 to a coalition of 44 attorneys general (43 states plus the District of Columbia) over a 2019 data breach at its former debt collection vendor, American Medical Collection Agency (AMCA). The agreement also requires Labcorp to strengthen its cybersecurity program, limit the sensitive information it shares with vendors and tighten oversight of the companies that collect its medical debts.

The breach potentially exposed information belonging to more than 27.5 million people nationwide, including approximately 10.2 million Labcorp patients. The agreement took effect on October 1, 2026, after Labcorp and the participating state officials signed the multistate Assurance of Voluntary Compliance and Discontinuance.

Patients cannot claim money from this $2.29 million settlement. The payment goes to the participating states, with no claim form, administrator or deadline for individuals. Labcorp’s separate $35 million consumer settlement over the same breach had a claim deadline of September 3, 2026, which has passed.

Quick Facts: Labcorp’s $2,287,455 Multistate Data Breach Settlement

Detail	Information
Exact settlement amount	$2,287,455
Company	Laboratory Corporation of America Holdings (Labcorp)
Debt collection vendor	Retrieval-Masters Creditors Bureau, doing business as American Medical Collection Agency (AMCA)
Government parties	44 attorneys general: 43 states and the District of Columbia
Lead announcement	Connecticut Attorney General William Tong
Effective date	October 1, 2026
Incident	AMCA data breach publicly reported in June 2019
People potentially affected nationwide	More than 27.5 million
Labcorp patients potentially affected	Approximately 10.2 million
Payment goes to	Participating states
Individual patient payment or claim form	None
Separate Labcorp consumer settlement	$35,000,000 (claim deadline September 3, 2026, passed)
Official multistate agreement	Signed Assurance of Voluntary Compliance and Discontinuance
Government announcement	Connecticut Attorney General’s official release

Why Did 44 Attorneys General Reach a Settlement With Labcorp Over the AMCA Breach?

AMCA collected medical debts for healthcare providers, including Labcorp, and its systems were breached. The breach happened at the vendor, but the information belonged to Labcorp patients. The attorneys general argued that healthcare businesses remain responsible for vetting and overseeing vendors they trust with sensitive personal and health information.

The agreement resolves potential government claims under state consumer protection laws, personal information protection laws, breach notification laws and federal health privacy provisions, including HIPAA. It does not establish that Labcorp admitted wrongdoing. It says the resolution was reached without a trial or adjudication and without any finding of liability.

How Did the AMCA Data Breach Affect Labcorp Patients?

The agreement defines the incident as the security breach publicly reported in June 2019, when AMCA and Labcorp notified approximately 10.2 million Labcorp patients that unauthorized people may have accessed certain AMCA systems. State attorneys general reported that more than 27.5 million people nationwide may have been exposed across AMCA’s client base. The information involved varied by person and included sensitive personal and protected health information that AMCA held while collecting medical debts. AMCA filed for Chapter 11 bankruptcy protection in June 2019, and the multistate coalition reached a separate settlement with AMCA in 2021.

Which Federal and State Laws Apply to the Labcorp and AMCA Data Breach Settlement?

The settlement does not find that Labcorp violated any of these laws. They are the legal framework the attorneys general used.

HIPAA Privacy and Security Rules (45 C.F.R. Parts 160 and 164). Covered entities like Labcorp must safeguard protected health information and have written business associate agreements requiring vendors that handle it to protect it (45 C.F.R. §§ 164.502(e), 164.504(e) and 164.308(b)). The Breach Notification Rule (45 C.F.R. §§ 164.400–414) requires notice to affected people after a breach of unsecured protected health information.

HITECH Act state enforcement (42 U.S.C. § 1320d-5(d)). This law lets state attorneys general sue to enforce HIPAA on behalf of residents and seek damages and injunctive relief. HIPAA itself gives individuals no private right to sue, which is why state attorneys general and state-law claims matter here.

State consumer protection laws. Each participating state has its own unfair or deceptive practices statute. For example, Connecticut’s is the Connecticut Unfair Trade Practices Act (Conn. Gen. Stat. § 42-110a et seq.), and Connecticut also has personal-information safeguarding and breach notification laws (Conn. Gen. Stat. §§ 42-471 and 36a-701b).

State breach notification and data security laws. Nearly every state requires businesses to protect personal information and to notify residents of breaches. California’s Civil Code § 1798.82 is one example.

Federal Trade Commission Act, Section 5 (15 U.S.C. § 45). The FTC can pursue unfair or deceptive data-security practices, though this settlement is a state-led matter.

Fair Debt Collection Practices Act (15 U.S.C. § 1692 et seq.). AMCA’s role as a collector places it under the federal debt-collection law. The agreement focuses on how Labcorp oversaw and contracted with collectors.

Related article: Jimmy John’s $975,000 Washington Job Posting Settlement, Who Gets Paid Without a Claim Form and What the November 13, 2026 Deadline Means (Hill v. Sandwich SC LLC, No. 25-2-08587-2 SEA)

What Must Labcorp Change Under the 2026 Multistate Settlement?

The requirements focus on outside debt collectors that handle sensitive patient information.

1. Strengthen Labcorp’s Information Security Program

Labcorp must review, revise and update its information security program within 120 days after the October 1, 2026 effective date and annually after that. The program must address how the company identifies risks and responds to incidents involving personal information and protected health information. Labcorp must also employ a qualified information security executive to oversee the program and advise senior leadership.

2. Improve Labcorp’s Incident Reporting and Employee Training

The agreement requires an incident response plan that covers vendor security events and provides timely reporting to senior management or the board. Labcorp must give security and privacy training to personnel who handle consumer personal information and protected health information. It has 180 days to provide the training or confirm that qualifying training was completed within the preceding 12 months. Training continues at least annually, and new personnel must be trained within 30 days of hire.

3. Share Less Patient Information With Labcorp’s Vendors

Labcorp must limit what it shares with third parties to the minimum necessary. It must also run a vendor risk management program with written policies, a dedicated evaluation team and tools for security assessments and monitoring, and it must keep an inventory of debt collector contracts, the data each handles and their risk ratings.

4. Require Stronger Security Terms in Labcorp’s Debt Collector Contracts

Within 12 months after the effective date, Labcorp must amend its existing debt collection contracts to include the agreement’s security requirements where they are not already there. These include:

• Separating Labcorp information from other clients’ data in shared environments when feasible, or taking alternative reasonable measures
• Limiting access to personal and health information
• Disposing of data under National Institute of Standards and Technology (NIST) standards
• Protecting cryptographic keys with appropriate controls
• Maintaining a process to address critical vulnerabilities reported by the U.S. Computer Emergency Readiness Team or an equivalent agency
• Annual risk assessments covering personal information and protected health information
• Annual penetration testing of relevant systems
• Annual SOC 2 Type 2 audits, biannual HITRUST CSF validated assessments or a reasonably equivalent external audit

The contracts must also set out each side’s responsibilities in a security incident, including consumer notices where required, and Labcorp must keep contractual rights to act against noncompliant collectors, including terminating their contracts.

5. Obtain an Independent Cybersecurity Assessment for Labcorp

Within 18 months after October 1, 2026, Labcorp must obtain an assessment from an independent professional who holds an appropriate cybersecurity certification and has at least five years of experience evaluating information security and vendor risk management. The assessor’s report goes to the Connecticut Attorney General within 60 days of completion, with confidentiality protections to the extent public records laws allow.

What Is the Court Record for the Labcorp Multistate Settlement?

The agreement is an Assurance of Voluntary Compliance and Discontinuance, not a conventional nationwide lawsuit with one federal case number. The Michigan filing associated with it identifies:

Detail	Record
Case caption	The People of the State of Michigan v. Laboratory Corporation of America Holdings
Case number	26-80-CP
Court	Michigan Circuit Court for the 30th Judicial Circuit, Ingham County
Document	Assurance of Voluntary Compliance and Discontinuance
Filing date in Michigan	September 24, 2026
Effective date	October 1, 2026

This is not the case number for the separate $35 million consumer litigation. The agreement releases covered civil claims that the participating attorneys general could have brought over the 2019 breach, subject to exceptions, and it preserves the states’ ability to enforce Labcorp’s obligations.

How Is the Labcorp Government Settlement Different From the $35 Million Consumer Settlement?

The $35 million settlement resolved In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, No. 19-md-2904, in the U.S. District Court for the District of New Jersey. It paid eligible consumers who filed claims. Its claim deadline was September 3, 2026, and its deadline for objections and exclusion requests was July 27, 2026. Both have passed, and the administrator’s document page lists a Final Approval Order and Judgment. The government settlement does not reopen that process.

For background on the consumer case, see $35M Labcorp AMCA Data Breach Settlement, Check If You Qualify In re AMCA Data Security Breach Litigation, No. 19-md-2904, File Claim Online by September 3.

How Will the States Use the $2,287,455 From Labcorp?

The states may use their payments for purposes their own laws allow, such as consumer protection enforcement, investigation costs and privacy-related enforcement. The agreement does not promise a check to affected patients. State allocations differ. For example, Connecticut is allocated $81,296, Michigan $85,717, Illinois $98,126 and North Carolina $100,427.

What Can Labcorp Patients Do After the AMCA Breach?

If you received a notification letter about the 2019 breach, keep it with your medical and financial records. Watch your financial accounts and medical billing statements for charges or services you don’t recognize, and contact the bank, insurer or provider using verified contact information. If you suspect identity theft, consider a fraud alert or credit freeze with the major credit bureaus and use the Federal Trade Commission’s IdentityTheft.gov. The settlement does not establish that every affected patient suffered identity theft or financial loss.

For another breach case involving potentially exposed personal and financial information, see Your Social Security Number May Be Stolen, 740,000 PNC Customers At Risk PNC Bank Again Facing A Class Action Lawsuit Over Data Breach. It involves a separate incident and should not be confused with the AMCA litigation.

For a separate healthcare data breach settlement with its own eligibility rules and deadlines, see General Physician P.C. $2.5M Data Breach Class Action Settlement, Claim Deadline is May 27, 2026.

Key Dates in the Labcorp and AMCA Data Breach Settlement

Date	Event
August 2018 – March 2019	Period of unauthorized activity in AMCA’s systems, per state announcements
June 2019	AMCA breach publicly reported; Labcorp patients notified; AMCA filed for Chapter 11
2021	Multistate coalition reached a separate settlement with AMCA
September 18, 2026	Labcorp signed the multistate assurance
September 22, 2026	Michigan’s representative signed the assurance
September 24, 2026	Attorneys general announced the agreement; Michigan filing made
October 1, 2026	Effective date of the assurance
October 31, 2026	General payment deadline (30 days after the effective date), subject to state-approval provisions
January 29, 2027	120 days after the effective date; first information security program update due
March 30, 2027	180 days after the effective date; initial training deadline, subject to its terms
October 1, 2027	12-month deadline to amend debt collector contracts
April 1, 2028	18-month deadline for the independent cybersecurity assessment

If a state needs judicial or other approval that it has not obtained by the payment deadline, the agreement allows payment within 30 days after the attorney general gives notice that final approval has been secured.

Frequently Asked Questions About Labcorp’s $2.29 Million Settlement

Can Labcorp patients file a claim for the $2,287,455 settlement?

No. The agreement pays the participating states and sets cybersecurity obligations for Labcorp. It creates no claims process.

Is the Labcorp $35 million data breach settlement still accepting claims?

No. Its claim deadline was September 3, 2026, and has passed. Check the administrator’s official website for any later payment or court updates.

How many attorneys general joined the Labcorp settlement?

Forty-four: 43 states and the District of Columbia.

How many people were potentially affected by the AMCA breach?

More than 27.5 million people nationwide, including approximately 10.2 million Labcorp patients.

Did the settlement establish that Labcorp violated HIPAA?

No. The agreement resolves potential claims without a trial or adjudication and states that it is not an admission of liability or wrongdoing.

Why was Labcorp held accountable for a breach at AMCA?

The attorneys general argued that Labcorp was responsible for vetting and overseeing the vendor that held its patients’ information. The settlement requires stronger contract terms, risk assessments, audits and vendor monitoring.

Does the Labcorp settlement stop patients from pursuing other legal claims?

The agreement releases specified government civil claims, subject to exceptions, and says it does not waive or limit private rights of action. Whether an individual can pursue a separate claim depends on the facts, the law, the consumer settlement’s releases and any deadlines.

Official Sources and Documents

1. Michigan Department of Attorney General, September 24, 2026: The People of the State of Michigan v. Laboratory Corporation of America Holdings, Case No. 26-80-CP, Assurance of Voluntary Compliance and Discontinuance. Read the complete agreement
2. Connecticut Office of the Attorney General, September 24, 2026: “Attorney General Tong Leads $2.3 Million Multistate Settlement with LabCorp Over the American Medical Collection Agency Data Breach.” Read the official Connecticut announcement
3. Court-authorized Labcorp settlement website: In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, Civil Action No. 19-md-2904 (D.N.J.). Read the official consumer settlement website
4. North Carolina Department of Justice, September 24, 2026: Read the North Carolina release

Disclaimer: This article is for general information only and is not legal advice. The $2,287,455 settlement is a government agreement, not a consumer claims fund. AllAboutLawyer.com is a legal information website, not a law firm.

Researched and written by Israr Ahmad, legal content researcher and founder of AllAboutLawyer.com. All facts verified against the signed Assurance of Voluntary Compliance and Discontinuance (Michigan Case No. 26-80-CP), the Connecticut and North Carolina attorney general announcements, and the court-authorized consumer settlement website, as of October 20, 2026. Last Updated: October 20, 2026.