RALEIGH, N.C. (WHKY) – North Carolina Attorney General Jeff Jackson and 44 other state attorneys general have reached a $2.2 million settlement with Labcorp following a multistate investigation into a 2019 data breach involving the company’s debt collector, the American Medical Collection Agency, or AMCA.

Labcorp will pay more than $2.28 million to the states, including about $100,000 to North Carolina. The breach exposed the personal information of more than 27.5 million people nationwide, including about 10.2 million Labcorp patients. More than 508,000 of those patients were North Carolinians.

The attorneys general said Labcorp had a responsibility to make sure its third-party vendors maintained strong security practices and protected sensitive patient information.

Under the settlement, Labcorp must strengthen its information security program, limit the amount of patient information shared with vendors, expand vendor risk management, and impose additional cybersecurity requirements on debt collectors.

Labcorp also must have a third-party assessor conduct an information security review focused on vendor risk management.

The settlement follows a separate 2021 agreement with AMCA after its bankruptcy case was dismissed. Labcorp has also agreed to a separate $35 million settlement in a related class-action lawsuit that remains ongoing.