AMCA, Quest and LabCorp Healthcare Vendor Breach (2019)

American Medical Collection Agency, known as AMCA, was a third-party medical billing collections vendor operated by Retrieval-Masters Creditors Bureau, Inc. It handled overdue balances for a long list of US healthcare providers and lab networks. Patients interacted with AMCA only when a small unpaid balance was passed to collections, often through a web payment portal that accepted credit cards and bank account information.

To do that work, AMCA had to receive and store sensitive patient and financial data: names, addresses, dates of birth, phone numbers, Social Security numbers in many cases, payment card data, and metadata about the original healthcare service. For some clients this also included references to lab tests and providers, which under HIPAA can constitute protected health information.

AMCA was a back-office vendor of vendors. Patients did not know about it. Investors did not know about it. Most board members at Quest, LabCorp, and BioReference had never seen the contract.

Based on public reporting from SEC 8-K filings by Quest Diagnostics, LabCorp, and Opko Health (BioReference's parent), the US Department of Health and Human Services Office for Civil Rights breach portal, court filings in the AMCA bankruptcy proceedings, and reputable cybersecurity research, the publicly reported timeline runs roughly as follows.

Initial compromise, approximately August 2018.An unauthorized actor gained access to AMCA's web payment portal infrastructure. Public reporting indicates the access persisted until roughly March 2019.

Detection. AMCA was notified of suspicious activity tied to payment cards processed through its portal, reportedly through banking and security industry channels.

Notification to clients, March to April 2019.AMCA notified its healthcare clients of the incident and began providing impact data to each one.

Public disclosures, May and June 2019. Quest Diagnostics filed an 8-K on 3 June 2019 disclosing exposure of approximately 11.9 million Quest patients. LabCorp disclosed approximately 7.7 million the next day. Opko Health/BioReference disclosed approximately 422,000 initially, later revised upward. Additional smaller clients made disclosures over the following weeks. Aggregate exposure climbed past 25 million records.

AMCA parent files for Chapter 11, June 2019.Retrieval-Masters Creditors Bureau filed for Chapter 11 bankruptcy protection on 17 June 2019, citing the cost of notification, response, and lost client business after the disclosures.

Regulatory and legal consequences. US state attorneys general opened multi-state investigations. A 2021 multi-state settlement included a 21 million US dollar amount to be paid by AMCA, with restrictions on its operating practices going forward. Quest, LabCorp, and BioReference faced class actions and additional regulatory scrutiny in their own right.

In plain English: an attacker got into AMCA's web payment portal, sat there for roughly eight months, and harvested patient and payment data as it flowed through. AMCA did not detect the intrusion on its own. The detection came from banking and payment industry signals.

Public reporting on the precise technical attack chain at AMCA is limited and was largely overtaken by the bankruptcy. From the available disclosures and the broader pattern of similar web-portal compromises in this period, the relevant elements include:

• Compromise of a web payment portal. The entry surface was AMCA's internet-facing payment portal, which accepted patient identifiers and payment data. Exposure persisted for roughly eight months.
• Long dwell time. Whatever the initial vulnerability, the more important failure was the lack of detection. Eight months of unauthorized access to a system processing payment card data and PHI is a structural monitoring failure.
• Sensitive data concentrated in one place.The portal received and held data from multiple major healthcare clients, which made one compromise sufficient to affect millions of patients across providers.
• External detection. Detection occurred not through AMCA's own monitoring but through industry channels tied to payment card abuse, which is a recurring pattern in third-party billing compromises.

The technical and operational control failures that mattered most:

• Limited security investment relative to the volume and sensitivity of data processed.
• Inadequate monitoring and detection on the payment portal.
• Excessive retention of patient and payment data inside the vendor environment.
• Customer-side TPRM that assessed paperwork (SOC 2, PCI attestations) but did not test operational controls.
• No timely or structured incident notification flow back to the healthcare clients.

No exploit code is included here. The defensive lesson is more useful than the offensive one.

AMCA was the canonical example of a low-visibility billing vendor producing a strategic third-party breach for the largest names on its client list.

• Vendor criticality was scored on the wrong factors.AMCA processed a small share of revenue but held PHI and payment data for tens of millions of patients. Its criticality from a data exposure perspective was extreme. Its criticality on most TPRM scorecards was not.
• Data concentration was unmanaged. Quest, LabCorp, and BioReference all sent collections data to AMCA. Concentration risk in the billing collections vertical was effectively national in scale, with no industry-level concentration map.
• Questionnaires measured paperwork, not operations.SOC 2 reports and PCI attestations were the standard of assurance. They did not surface the actual operating posture of the payment portal.
• Notification SLAs were too slow. The dwell time was eight months. The notification to healthcare clients was slow enough that affected patients learned months after exposure had ended.
• Retention was not contractually limited.Patient and payment data lived inside the vendor longer than the business reason required, increasing the population affected once a compromise occurred.
• Vendor financial resilience was not assessed.AMCA filed for bankruptcy within weeks of disclosure. That outcome left the healthcare clients to absorb most of the practical response cost and reputational damage.
• Subcontractor and downstream vendors were invisible to patients.Patients had no awareness that a billing vendor existed between them and the lab. The trust chain was longer than they had agreed to.

The AMCA incident produced one of the highest-profile business-associate breaches in HIPAA history at the time.

For AMCA and its parent. Retrieval-Masters Creditors Bureau filed for Chapter 11 bankruptcy on 17 June 2019, citing notification costs, lost client business, and response expenses. AMCA effectively did not survive the incident as a viable entity.

For the major clients. Specific consequences included:

• Quest Diagnostics: approximately 11.9 million patients affected; multi-state regulatory action and class action exposure.
• LabCorp: approximately 7.7 million patients affected; parallel regulatory action and class action exposure.
• Opko Health/BioReference Laboratories: approximately 422,000 patients initially, revised upward over time.
• Additional smaller healthcare and clinical clients made parallel disclosures, with aggregate exposure climbing above 25 million records.
• Multi-state attorney general investigation culminating in a 2021 settlement.
• Sustained class action litigation in multiple jurisdictions.
• Long-term increase in regulatory and customer expectations for business associate cybersecurity in US healthcare.

AMCA reshaped how US healthcare boards and regulators view business associate risk.

• HHS Office for Civil Rights elevated the visibility of business associate breaches and continued to enforce HIPAA against both covered entities and business associates.
• A multi-state attorney general settlement in 2021 imposed a 21 million US dollar amount on AMCA, along with practice restrictions, after the entity emerged from bankruptcy.
• Healthcare providers reassessed billing collections relationships and increased due diligence on data retention, monitoring, and incident response.
• SEC scrutiny of cyber disclosure timeliness, which culminated in the 2023 SEC rules on cybersecurity disclosure, was informed in part by incidents like AMCA.
• Industry awareness of the gap between SOC 2 paperwork and operational reality increased materially, even though closing that gap remains an open challenge.

Some consequences are confirmed and measurable. Others, such as the long-term shift in business associate contracting and the legal precedent on vendor financial resilience, continue to evolve.

1. Score vendors on data exposure, not on spend. A small billing vendor holding tens of millions of patient records is a tier-one third party.
2. Inventory every back-office vendor that touches regulated data, including collections, billing, claims processing, and print and mail.
3. Test operational controls, not just paperwork. Validate monitoring, patching, MFA, and detection at critical vendors.
4. Require strict retention limits in contracts. Files that no longer exist cannot be stolen.
5. Define notification SLAs in hours, not months, and rehearse them with critical vendors.
6. Assess vendor financial resilience. A vendor that cannot survive disclosure is not a vendor you can rely on for incident response.
7. Require third-party detection capabilities and accept evidence of independent monitoring, not just policy.
8. Map data flow from your environment into the vendor, into any sub-processor, and back out. Patients deserve to know who holds their data.
9. Pre-build patient and regulator communication templates for business associate breaches.
10. Put back-office vendor concentration on the board agenda, especially in healthcare and financial services.

Most summaries describe AMCA as a billing-vendor breach. That is true but it understates the structural lesson.

The first thing people miss is the dwell time. The portal was compromised for roughly eight months. The breach was not primarily a technical sophistication story. It was a monitoring story. AMCA simply did not have the operational capability to notice an intruder camping inside its core customer-facing system.

The second thing people miss is the financial resilience issue. AMCA filed for bankruptcy weeks after disclosure. That outcome should be treated as one of the most important TPRM signals of the decade: a critical vendor that cannot survive its own incident is not a vendor that can help you respond to it.

The third thing people miss is the patient experience. The people whose data was stolen had no relationship with AMCA. They had a relationship with Quest, LabCorp, or BioReference. The breach travelled one relationship further than they had agreed to, and the apology had to come from the brand they knew, not the vendor that lost the data.

A billing vendor can quietly hold millions of sensitive records, remain compromised for the better part of a year, and disappear into bankruptcy weeks after disclosure. AMCA was the moment US healthcare learned that back-office third parties holding regulated data are tier-one risks, that paperwork is not a control, and that the patient does not care which vendor lost the data. They will hold the brand they trusted accountable.