HARRISBURG — Attorney General Josh Shapiro today announced that Pennsylvania, along with 41 Attorneys General, has settled with Retrieval-Masters Creditors Bureau, doing businesses as the American Medical Collection Agency (AMCA), resolving a multistate investigation into the 2019 data breach that exposed the personal information of over seven million individuals. AMCA served as the debt collector for LabCorp, Quest Diagnostics, and other medical service providers.
“American Medical Collection Agency failed in its responsibility to safeguard consumers’ sensitive healthcare information,” said Attorney General Shapiro. “They were repeatedly warned that there were serious flaws in their system, but still they did not take appropriate steps to fix it. They left their system vulnerable to a massive data breach, and the personal identifying information for millions of Americans was put at risk. This settlement ensures that American Medical Collection Agency must do the right thing and fix the security failures that led to a preventable data breach.”
Retrieval-Masters Creditors Bureau is a debt collection agency. Under the name American Medical Collection Agency, or AMCA, the company specialized in small balance medical debt collection primarily for laboratories and medical testing facilities. An unauthorized user gained access to AMCA’s internal system from August 1, 2018 through March 30, 2019. AMCA failed to detect the intrusion, despite warnings from banks that processed its payments. The unauthorized user was able to collect a wide variety of personal information, including Social Security numbers, payment card information, and, in some instances, names of medical tests and diagnostic codes.
On June 3, 2019 AMCA provided notice to many states, and began providing notice to more than seven million affected individuals that included an offer of two years of free credit monitoring. On June 17, 2019, as a result of the costs associated with providing notification and remediating the breach, AMCA filed for bankruptcy. In order to continue the investigation and take steps to ensure that the personal information of their residents was protected, the multistate coalition participated in all bankruptcy proceedings through the Attorneys General of Indiana and Texas. The company ultimately received permission from the bankruptcy court to settle with the multistate, and on December 9, 2020, filed for dismissal of the bankruptcy.
Under the terms of the settlement, AMCA and its principals have agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers. These include:
- Creating and implementing an information security program with detailed requirements, including an incident response plan;
- Employing a duly qualified Chief Information Security Officer;
- Hiring a Third-Party Assessor to perform an information security assessment; and
- Cooperating with the Attorneys General with investigations related to the data breach and maintaining evidence.
As part of the settlement, AMCA may be liable for a $21 million total payment to the states. Because of AMCA’s financial condition, that payment is suspended unless the company violates certain terms of the settlement agreement.
# # #