Healthcare data breaches usually dominate headlines for a few weeks before public attention shifts elsewhere.
The American Medical Collection Agency (AMCA) breach followed a different path.
Nearly eight years after attackers infiltrated the debt collection company’s systems, Labcorp has agreed to a proposed $35 million class action settlement, bringing fresh attention to one of healthcare’s most significant third-party cybersecurity incidents. The agreement resolves years of litigation, yet it also reminds healthcare organizations that vendor-related cyber risks remain far from solved.
Unlike many settlements that close the conversation, this one raises an even bigger question.
If a trusted business partner experiences a cyberattack, where does responsibility ultimately end?
The Story Behind the Settlement
Every major cybersecurity incident has a defining weakness.
For this case, that weakness wasn’t Labcorp’s own network.
Instead, the breach occurred at American Medical Collection Agency (AMCA), formally known as Retrieval-Masters Creditors Bureau, Inc. The company handled medical debt collection services for several healthcare organizations, including Labcorp.
Attackers maintained unauthorized access to AMCA’s payment systems between August 2018 and March 2019 before the incident was discovered.
Because Labcorp had shared patient information with AMCA for billing purposes, approximately 10.25 million Labcorp patients were affected by the breach.
Depending on the individual, exposed information included names, addresses, phone numbers, dates of birth, account balances, payment details, and certain medical or billing information.
Why the Case Returned to the Headlines
Cybersecurity incidents rarely stay active in the news for nearly a decade.
Legal proceedings often do.
Labcorp has agreed to establish a $35 million settlement fund while continuing to deny any wrongdoing. According to the company, resolving the litigation avoids additional legal costs and uncertainty associated with prolonged court proceedings.
The proposed settlement now awaits final court approval in the U.S. District Court for the District of New Jersey.
Breaking Down the Settlement
Rather than providing identical compensation to every claimant, the agreement offers several benefit options.
Eligible class members may receive:
| Available Benefit | Details |
| Documented Loss Reimbursement | Up to $5,000 for qualifying expenses related to fraud, identity theft, credit monitoring, or professional services. |
| Lost Time Payment | Up to 10 hours at $25 per hour for time reasonably spent responding to the breach. |
| Alternative Cash Payment | Available for eligible class members without documented losses. Final amounts depend on approved claims. |
| Identity Protection | Two years of CyEx Medical Shield Pro monitoring services. |
Current settlement deadlines include:
- July 27, 2026 – Deadline to exclude yourself or file an objection.
- August 20, 2026 – Final approval hearing.
- September 3, 2026 – Deadline to submit a claim.
Why This Breach Still Matters
Several years have passed since the original cyberattack.
However, healthcare’s operating model has changed very little.
Hospitals, laboratories, physician practices, pharmacies, insurers, and diagnostic companies continue relying on hundreds of outside vendors.
Those partners routinely process:
- Patient billing information.
- Laboratory payment records.
- Insurance transactions.
- Medical collections.
- Cloud-hosted healthcare applications.
- Customer support services.
Consequently, every additional vendor creates another cybersecurity dependency.
Organizations may never experience a direct attack.
Nevertheless, they can still experience direct consequences.
The Vendor Risk Conversation Has Changed
Before AMCA, vendor assessments often focused on questionnaires completed during contract negotiations.
After AMCA, many healthcare organizations adopted continuous oversight instead.
Security leaders increasingly ask:
- Does the vendor undergo independent cybersecurity assessments?
- How quickly will security incidents be reported?
- Who verifies ongoing compliance after the contract is signed?
- How frequently are third-party security controls reviewed?
These questions have become standard components of healthcare procurement.
Lessons Hidden Inside the Settlement
Although the financial agreement receives the most attention, the operational lessons may prove even more valuable.
Vendor Relationships Require Continuous Monitoring
Security reviews performed once during procurement cannot identify changing cyber risks over time.
Continuous monitoring provides greater visibility into evolving threats.
Business Associate Agreements Need Regular Updates
Cybersecurity expectations have changed dramatically since 2018.
Organizations should review Business Associate Agreements periodically to ensure responsibilities remain clearly defined.
Incident Response Should Include Business Partners
Healthcare providers frequently test internal response plans.
Fewer organizations rehearse incidents involving outside vendors.
Joint planning improves coordination during real cybersecurity events.
Patients Are Watching More Closely
Healthcare data differs from most personal information.
Medical histories cannot simply be replaced.
Insurance information remains valuable to cybercriminals.
Laboratory records often contain highly sensitive personal details.
Consequently, patients increasingly evaluate healthcare organizations according to how they protect informationnot simply how they deliver care.
That expectation extends to every company handling patient information.
Cybersecurity Has Become a Supply Chain Issue
The Labcorp settlement reflects a larger industry trend.
Healthcare cybersecurity no longer depends solely on firewalls, endpoint protection, or internal security teams.
Instead, it depends on entire digital ecosystems.
One vendor’s weakness can affect millions of patients.
One compromised business partner can trigger years of litigation.
One overlooked security assessment can become a multimillion-dollar settlement.
Those realities continue reshaping healthcare compliance programs.
Federal Attention Continues to Grow
Recent months have seen continued federal focus on healthcare cybersecurity, ransomware preparedness, third-party risk management, and HIPAA compliance.
Regulators continue emphasizing stronger oversight of business associates responsible for handling protected health information.
The Labcorp settlement fits squarely within that broader regulatory trend.
Healthcare organizations increasingly recognize that vendor governance represents both a cybersecurity responsibility and a compliance obligation.
What Healthcare Organizations Should Review Now
Rather than waiting for another high-profile settlement, organizations should evaluate existing vendor management programs.
Priority areas include:
- Reviewing Business Associate Agreements to ensure security responsibilities remain current.
- Performing recurring cybersecurity assessments instead of relying on one-time reviews.
- Identifying vendors with access to sensitive patient information and ranking them according to risk.
- Testing incident response procedures involving third-party service providers.
- Documenting oversight activities to demonstrate ongoing compliance efforts.
Looking Beyond the Settlement
The proposed $35 million agreement closes one lawsuit.
It does not close the larger discussion surrounding healthcare cybersecurity.
The AMCA breach demonstrated that patient information remains vulnerable long after it leaves the healthcare provider’s own systems.
That lesson continues influencing vendor governance, regulatory expectations, cybersecurity investments, and compliance strategies throughout the healthcare industry.
For healthcare leaders, the settlement represents more than compensation.
It serves as another reminder that protecting patient information requires visibility across the entire healthcare supply chainnot just within organizational walls.
