RELEASE: OFFICE OF CONSUMER PROTECTION ANNOUNCES MULTISTATE DATA BREACH SETTLEMENT
STATE OF HAWAIʻI
KA MOKU ʻĀINA O HAWAIʻI
JOSH GREEN, M.D.
GOVERNOR
KE KIAʻĀINA
DEPARTMENT OF COMMERCE AND CONSUMER AFFAIRS
KA ʻOIHANA PILI KĀLEPA
NADINE Y. ANDO
DIRECTOR
KA LUNA HOʻOKELE
OFFICE OF CONSUMER PROTECTION
MANA MORIARTY
EXECUTIVE DIRECTOR
OFFICE OF CONSUMER PROTECTION ANNOUNCES MULTISTATE DATA BREACH SETTLEMENT
FOR IMMEDIATE RELEASE
September 29, 2026
HONOLULU – The Hawaiʻi Department of Commerce and Consumer Affairs Office of Consumer Protection (“OCP”), as part of a coalition of 44 attorneys general, has settled with the Laboratory Corporation of America (“Labcorp”) resolving the multistate investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (“AMCA”).
The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients of which 17,347 are Hawaiʻi residents. The multistate coalition settled with AMCA in 2021 after the company’s bankruptcy petition was dismissed.
“People in Hawaiʻi should feel confident their personal and health information is protected. This settlement makes clear that HIPAA‑covered organizations can’t pass the buck to their vendor when it comes to HIPAA compliance,” said Mana Moriarty, executive director of the Office of Consumer Protection. “Stronger vendor‑management rules mean better protection for patients and help prevent the kind of large‑scale data exposure we saw in the AMCA breach.”
Although the breach occurred at AMCA, the compromised data belonged to Labcorp’s patients. Companies may contract with vendors and delegate tasks, but data security remains a non-delegable duty — and HIPAA-covered entities must oversee the vendors entrusted with personal and health information. The settlement establishes strong vendor management requirements, particularly for medical debt collection, including:
- Developing certain aspects of the company’s information security program, such as an incident response plan that includes internal reporting of vendor security events;
- Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
- Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
- Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contract, segmenting data which is often aggregated by debt collectors for multiple clients, and requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
- Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management.
As part of the settlement, Labcorp will make a payment of $2,287,455.00 to the states, of which $17,628 is payable to Hawaiʻi. This settlement will supplement a multistate settlement with AMCA itself which included a $21,000,000 suspended payment due to its bankruptcy. Separately Labcorp has agreed to a $35,000,000 settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.
The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan and Texas led the investigation. They were assisted by the Executive Committee of the Attorneys General of Maryland, Massachusetts, New York, North Carolina and Tennessee, who were joined by the Attorneys General of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, Wisconsin and West Virginia, as well as the Office of Consumer Protection in Hawaiʻi.
# # #
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
