These questions are common in compliance team meetings and privacy officer discussions. After Labcorp agreed to a $2.29 million settlement over a 2019 breach involving its debt collector, AMCA, concerns have surfaced: How much oversight is enough? What belongs in a Business Associate Agreement? How do you verify a vendor's security posture?
The Labcorp case exposed personal information of more than 27.5 million people, including about 10.2 million Labcorp patients. The breach didn't occur in Labcorp's systems but at AMCA, a debt collection vendor with access to patient names, addresses, dates of birth, account balances, and sometimes Social Security numbers.
Here's what compliance teams are asking now.
Can we be held liable for what a vendor does?
Yes. Under HIPAA, you're responsible if you fail to obtain satisfactory assurances from a Business Associate, don't establish a required Business Associate Agreement, or ignore known noncompliance. The Office for Civil Rights (OCR) focuses on whether you did your due diligence before handing over Protected Health Information (PHI).
The Labcorp settlement reinforces this. Even though the breach happened at AMCA, the investigation focused on Labcorp's oversight practices. The settlement requires Labcorp to limit information shared with vendors, assess vendors' security practices, and impose additional cybersecurity requirements on debt collectors handling patient information.
Your vendor's failure becomes your compliance problem.
What do I need to verify before signing a vendor contract?
Start with three baseline checks: Does the vendor have documented security policies? Can they demonstrate how they segment data from different clients? Do they have an incident response plan that includes notification timelines?
The Labcorp settlement requires the company to establish processes for verifying that vendors comply with security requirements. You can't just accept a vendor's assurances at face value. You need evidence.
Ask for recent security assessments. Request copies of their incident response procedures. If they handle Electronic Protected Health Information (ePHI), confirm they encrypt data at rest and in transit. If they can't produce documentation, walk away.
How much patient information should we share with vendors?
Only what they need to perform the contracted service. This principle, data minimization, is part of the HIPAA Security Rule's Addressable and Required Specifications.
The Labcorp settlement requires the company to reduce the amount of patient information shared with vendors where possible. In the AMCA breach, the debt collector had access to names, addresses, dates of birth, referring physicians, dates of service, and account balances. Some records included Social Security numbers and health insurance information.
Review every data field you're sending. Does your billing vendor really need dates of birth, or would account numbers suffice? Does your collection agency need referring physician names? Every unnecessary data element you share multiplies your breach exposure.
What should our Business Associate Agreement say about security?
Your BAA must require the Business Associate to implement appropriate safeguards, report security incidents, and allow you to terminate the agreement if they fail to meet security requirements.
The Labcorp settlement requires the company to impose specific cybersecurity requirements through contracts and maintain termination rights when vendors fail to meet those requirements. Your BAA should specify technical standards, not just general obligations.
Include requirements for encryption, access controls, audit logging, and incident notification timelines. Specify that the vendor must report security incidents involving your data within a defined timeframe. The settlement requires Labcorp to have an incident response plan that mandates internal reporting of vendor security incidents.
Don't accept boilerplate language. If your vendor pushes back on specific security requirements, that's a red flag.
Do we need a dedicated person or team managing vendor risk?
If you work with multiple Business Associates, yes. The Labcorp settlement requires the company to establish a dedicated vendor risk management function with tools for assessing vendors.
This doesn't necessarily mean hiring a full-time vendor risk manager at a small practice. But someone on your team needs ownership. They should maintain an inventory of Business Associate contracts, track assessment schedules, and monitor compliance with security requirements.
At larger organizations, vendor risk management should be a defined role with clear responsibilities: conducting security assessments, reviewing audit reports, tracking remediation timelines, and escalating noncompliance issues.
How often should we reassess our vendors?
At minimum, annually. High-risk vendors handling large volumes of ePHI or performing critical functions should be assessed more frequently.
The Labcorp settlement requires debt collectors to be subject to security assessments and audits. That means ongoing oversight, not a one-time review at contract signing.
Your reassessment should include reviewing recent security incidents, confirming current certifications, and verifying that promised controls remain in place. If a vendor experienced a breach or significant security incident during the year, conduct an immediate reassessment before continuing the relationship.
What happens if we discover our vendor isn't meeting security requirements?
You have three options: require remediation with a timeline, restrict their access to PHI until they comply, or terminate the contract.
The Labcorp settlement requires contracts to include termination rights when vendors fail to meet security requirements. Your BAA should spell out the process: written notice of noncompliance, a reasonable cure period, and termination if the vendor doesn't remediate.
HIPAA requires you to take reasonable steps to cure the breach or end the violation. If you discover noncompliance and do nothing, you're now part of the compliance problem.
Should we hire someone to audit our vendor management program?
If you're a large organization or work with high-risk vendors, an independent assessment adds credibility and often catches gaps your internal team misses.
The Labcorp settlement requires the company to hire an independent third-party assessor to evaluate its information security program, with a focus on vendor risk management. That's a strong signal that regulators expect external validation of vendor oversight practices.
Even if you're not under a consent decree, consider periodic third-party assessments of your vendor risk program. An assessor following NIST SP 800-66 guidance can verify that your processes align with HIPAA Security Rule requirements and identify weaknesses before they become breaches.
Where to go for more
Start with your existing Business Associate Agreements. Review each one against the requirements outlined above. If your agreements lack specific security requirements, termination rights, or incident reporting timelines, schedule renewals.
Build or update your vendor inventory. Document what PHI each Business Associate receives, when you last assessed their security, and when the next review is due.
If you don't have a dedicated vendor risk management process, create one now. The Labcorp settlement makes clear that regulators expect structured, documented oversight of Business Associates. Waiting for a breach to force the issue costs more than building the program today.
