Alaska asks Anchorage judge to approve LabCorp data breach settlement

Alaska's share of a $2.29 million settlement with LabCorp over a 2019 data breach is not stated in any document the public can read. Neither is the number of affected Alaska residents.

Acting Attorney General Cori Mills's office filed a petition Thursday in Anchorage Superior Court asking a judge to approve the settlement with Laboratory Corporation of America Holdings. Alaska law, AS 45.50.511, requires such an assurance of voluntary compliance, a negotiated promise to change conduct, to be filed with and approved by the court first. The statute also says an assurance is not an admission of wrongdoing and lets the attorney general reopen the matter later.

The same day, 44 states and the District of Columbia announced the settlement. It resolves an investigation into a breach at Retrieval-Masters Creditors Bureau, the debt collector doing business as American Medical Collection Agency, which LabCorp used to collect medical debts. Unauthorized access to the collector's system ran from Aug. 1, 2018, through March 30, 2019. LabCorp announced the breach on June 4, 2019. About 10.2 million LabCorp patients were notified, out of more than 27.5 million people affected across the collector's clients, according to the Connecticut attorney general. LabCorp has said its own systems were not affected and that no ordered tests, results or diagnostic information from the company were in the affected system.

"Labcorp outsourced their debt collection, and they shared sensitive personal information for millions of patients that was ultimately compromised. Labcorp was responsible for vetting and managing that vendor, and we're holding them accountable," Connecticut Attorney General William Tong said.

Connecticut receives $81,296 and counts 43,666 affected residents. Delaware receives $30,135. Each state's copy of the assurance names only that state's payment, so Alaska's figure would appear only in the petition just filed. The Alaska Department of Law has published nothing about the settlement; its most recent consumer protection release is dated Sept. 22, two days before the filing.

The settlement requires LabCorp to appoint a chief information security officer and obtain an independent third-party assessment of its vendor-risk management within 18 months of the Oct. 1 effective date. Those vendor-management obligations expire five years later, on Oct. 1, 2031. It supplements a 2021 multistate deal with the debt collector that included a $21 million payment suspended because of its bankruptcy. The money goes to the states, not consumers. LabCorp separately agreed to pay $35 million in related class-action litigation, still ongoing against other companies the collector served.

Payment is normally due within 30 days of the Oct. 1 effective date, but where a state has not yet secured court approval, it is due 30 days after the attorney general certifies that approval is secured.