Cybersecurity · Industry brief

Laboratory Corporation of America Holdings (Labcorp) reached a settlement with 44 state attorneys general and the District of Columbia, agreeing to pay $2,287,455 and overhaul its vendor oversight programs effective October 1, 2026. The settlement resolved an investigation stemming from a 2019 data breach at one of Labcorp's debt collection vendors involving protected health information. The agreement requires Labcorp to implement comprehensive vendor risk management protocols, including annual security program reviews, appointment of a chief information security officer, and mandatory industry-recognized cybersecurity standards compliance (such as NIST Cybersecurity Framework) for all vendors handling PHI. Debt collection vendors must now comply with specific data security requirements including network segmentation, cryptographic key management, annual penetration testing, and either SOC 2 Type 2 or HITRUST CSF audits, with Labcorp required to obtain independent third-party compliance verification within 18 months. The enforcement action signals that state attorneys general now treat vendor oversight as a priority enforcement issue, establishing precedent that organizations cannot outsource responsibility for protecting sensitive data handled by third parties.

Boston Children's Health Physicians and managed IT service provider XTIUM settled a New York and Connecticut Attorneys General investigation into an August 2024 data breach affecting approximately 890,000 individuals. The settlement imposed a $4 million penalty ($2.7 million paid to the states, $1.3 million suspended contingent on compliance), with New York receiving $2.1 million and Connecticut $540,000. The investigation found XTIUM failed to implement reasonable safeguards for remote access tools and lacked logging/monitoring, while BCHP failed to enforce standard security policies, used unrestricted shared administrative accounts, and had not addressed security gaps identified in a 2023 third-party audit. Both entities were determined to have violated the HIPAA Security Rule and New York Executive Law. Mandated improvements include maintaining accurate inventories of private information, implementing reasonable authentication procedures, establishing logging and monitoring systems, and enhancing threat response procedures.