Laboratory Corporation of America (Labcorp) settled with multiple states to resolve an investigation into a 2019 data breach suffered by Labcorp's debt collector, American Medical Collection Agency (AMCA).

The data breach at AMCA potentially exposed the data of more than 27.5 million people, including 10.2 million Labcorp patients.

The settlement requires Labcorp to pay $2,287,455 to the states involved and includes other requirements regarding vendor management, including:

· Developing security information programs, including incident response plans that include reporting vendor security events

· Minimizing data shared with vendors while balancing the data needs of those vendors to provide services

· Expanding vendor risk management programs to include a dedicated team, evaluation tools, and compliance verification

· Adding specific debt collector requirements, including enforcing cybersecurity standards, segmenting data, requiring debt collectors to perform assessments and audits, and allowing termination for non-compliance

· Hiring a third-party assessor to perform information security assessments, specifically focusing on vendor security risk

Source: https://coag.gov/press-releases/attorney-general-phil-weiser-announces-2-3m-national-settlement-with-labcorp-over-data-breach/

Commentary

Contracts with vendors should make IT security a priority, especially if a breach of the vendor can affect your organization, like the breach of AMCA that led to the loss to Labcorp.

Organizations may negotiate strong security terms, yet may not be able to enforce those terms if the vendor fails to meet them.

The Labcorp settlement above includes requirements for assessments and audits as well as provisions for terminating debt collectors for non-compliance with security protocol.

All assessments and audits required in a contract should be thoroughly documented, linking compliance gaps to remediation measures, and when appropriate, termination. Not every compliance failure will warrant termination. Each failure should be evaluated based on severity, risk, and remediation.

Organizations can assess vendor cybersecurity compliance both before and after working with them by administering security questionnaires, using third-party risk assessment companies for monitoring, validating how access controls are handled, auditing past incident responses, and requiring frequent vulnerability scans accompanied by addressing any issues that are revealed.

The final takeaway is that organizations must ensure they have proper assessment and audit measures in place to evaluate vendor cybersecurity, as well as a termination plan for vendors who fall short of compliance.