One of healthcare’s worst-ever data breaches has moved closer to a partial resolution, with a proposed $6,438,578.20 pool now before a federal judge in New Jersey. The money settles the “Other Labs Track” of litigation against American Medical Collection Agency and four lab clients, per filings reported this week. Funding the pool without admitting fault are Sonic Healthcare U.S.A., Aurora Diagnostics, Clinical Pathology Laboratories, and Austin Pathology Associates.
Chasing small-balance medical bills for clinical labs was the business of AMCA, a debt-collection subsidiary of Retrieval-Masters Creditors Bureau. Its web payment portal was breached, and sensitive records sat exposed from August 2018 through March 2019. Government identifiers, names, contact details, billing records, and financial account and payment data all fell into the wrong hands. The incident is thought to have touched more than 27 million people – the largest lab-related breach on record.
CyEx Medical Shield Pro monitoring of medical and health information, covering two years, is what class members may claim. Two other options are on the table: documented out-of-pocket losses reimbursed up to $5,000, or a single cash payment estimated near $50. Opting out or objecting requires action by December 3, 2026; claims are due January 4, 2027.
What labs and health systems should take from this: six years of litigation show how far liability reaches down the vendor chain. A diagnostic lab that hands billing and collections to a third party can still be named in a suit and can still end up writing the check. Contracting teams ought to re-examine indemnification language, breach-notification timelines, and cyber insurance limits for every revenue-cycle vendor touching patient billing data.
