Labcorp
Medical records run on two clocks, and only one of them is yours: retention law keeps the clinical file for years or decades whatever you ask. Around it, what you looked up can become an advertising interest, and a deletion request usually comes back half done.
Reported incidents
Pays 44 attorneys general over 10.2 million patients' data taken from a vendor
2026-09-25Affected Billing and debt collection through the vendor AMCA
Labcorp agreed an Assurance of Voluntary Compliance with the attorneys general of 43 states and the District of Columbia over the breach at its former debt collection vendor, American Medical Collection Agency, announced in June 2019. About 10.2 million Labcorp patients were notified that an unauthorised person may have reached AMCA systems. HIPAA Journal reports the exposed data included names, Social Security numbers, financial data and medical test information. Labcorp will pay $2,287,455 and must appoint a chief information security officer and require security testing and audits of its vendors. The agreement takes effect on 1 October 2026.
People affected typically ask Labcorp to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.