Laboratory Corporation of America Holdings Notice Regarding AMCA Security Incident

July 13, 2019

A former vendor of Laboratory Corporation of America Holdings (LabCorp), American Medical Collection Agency (AMCA), has notified LabCorp about a security incident AMCA experienced that may have involved certain personal information about some of our patients. LabCorp’s systems were not impacted by this incident. AMCA is an external collection agency that was used by LabCorp and other companies. LabCorp referred patient balances to AMCA only when our direct collection efforts were unsuccessful.

LabCorp was informed on May 14, 2019 that AMCA may have experienced unauthorized activity on its web payment page. Upon learning of this event, LabCorp promptly stopped sending new collection requests to AMCA and stopped AMCA from continuing to work on any pending LabCorp collection requests. AMCA has told us it appears that an unauthorized user had access to their system between August 1, 2018 and March 30, 2019 and that they cannot rule out the possibility that personal information on AMCA’s system was at risk during that time period. Information on AMCA’s affected system may have included name, address, and balance information for the patient and person responsible for payment, along with the patient’s phone number, date of birth, referring physician, and date of service. In addition, health insurance information may have been included for some individuals, and because some insurance carriers utilize the Social Security Number as a subscriber identification number, the Social Security Number for some individuals may also have been affected. No ordered tests, laboratory test results, or diagnostic information were in the AMCA affected system.

LabCorp will individually notify potentially impacted individuals for whom it has a valid mailing address. For the individuals whose Social Security Number was affected, the notice will include an offer to enroll in credit monitoring and identity protection services that will be provided free of charge for 24 months. Impacted individuals are advised to regularly monitor any insurance explanation of benefits or other account statements to check for any unfamiliar charges or items. If an individual notices any discrepancy on one of these statements, that individual should contact their health plan, financial institution, or law enforcement authorities, as appropriate.

LabCorp takes our responsibility to safeguard personal information seriously, including information handled by our vendors, and we remain committed to protecting patient privacy and security. We continue to work closely with our vendors and business associates to enhance the security of patient health and personal information. Individuals with questions about this situation should contact our dedicated assistance line at 844-386-9555 from 6:00 AM to 8:00 PM Pacific Time, Monday through Friday, and 8:00 AM to 5:00 PM Pacific Time, Saturday and Sunday (excluding major U.S. holidays).

Frequently Asked Questions

1. What happened?​

• AMCA is an external collection agency that was used by LabCorp and other companies. 
• LabCorp referred patient balances to AMCA only when LabCorp’s direct collection efforts were unsuccessful. 
• AMCA’s affected system included certain personal information that was provided by LabCorp and by individuals. 
• AMCA has told LabCorp that an unauthorized user had access to AMCA’s system between August 1, 2018 and March 30, 2019 and that AMCA cannot rule out the possibility that personal information on AMCA’s system was at risk during that time period. 

2. When did LabCorp learn about the AMCA incident?

• On May 14, 2019, LabCorp was informed by American Medical Collection Agency (AMCA) about unauthorized activity on an AMCA information technology system. 
• Upon learning of this event, LabCorp promptly stopped sending new collection requests to AMCA and stopped AMCA from continuing to work on any pending LabCorp collection requests. LabCorp also began an investigation into the incident.

3. What information was on AMCA's affected system?

• LabCorp provided no ordered tests, laboratory test results, or diagnostic information to AMCA, so none of that information was in the AMCA affected system.
• The information on AMCA’s affected system may have included name, address, and balance information for the patient and person responsible for payment, along with the patient’s phone number, date of birth, referring physician, and date of service.   
• In addition, health insurance information may have been included for some individuals, and because some insurance carriers utilize the Social Security Number as a subscriber identification number, the Social Security Number for some individuals may also have been affected. 

4. What is LabCorp doing about the AMCA incident?

• Upon learning of this event, LabCorp promptly stopped sending new collection requests to AMCA and stopped AMCA from continuing to work on any pending LabCorp collection requests. LabCorp also began an investigation into the incident.
• LabCorp has notified all potentially impacted individuals. In addition, a notice is posted to LabCorp’s website, and notice was also sent to a newspaper in each state.
• LabCorp has offered individuals whose Social Security Number may have been affected credit monitoring and identity protection services that will be provided free of charge for 24 months. 
• AMCA had previously provided notices to approximately 200,000 LabCorp consumers whose credit card or bank account information may have been on AMCA’s affected system, and it offered those consumers free credit monitoring and identify protection services. 
• Some consumers who received notice from AMCA may have also received a notice from LabCorp.

5. How can I get more information about the AMCA incident?

• Individuals who have received a notice letter from LabCorp about the AMCA incident should contact LabCorp’s dedicated assistance line at 844-386-9555.
• Individuals who did not receive a notice letter about the AMCA incident from LabCorp can contact LabCorp Customer Service with questions about the AMCA incident by calling 888-295-0466, sending an email to [email protected], or reviewing LabCorp’s website for information: https://www.LabCorp.com/AMCA-data-security-incident.
• All media inquiries should be directed to LabCorp Corporate Communications at [email protected] or 336-436-8263. 

Sept. 13, 2019