Letter to Russell Fuchs, President of the American Medical Collection Agency - Menendez, Booker Target Medical Billing Company at Center of Quest, LabCorp Patient Data Breach

Letter

June 7, 2019

Russell Fuchs

American Medical Collection Agency

4 Westchester Plaza, Suite 110

Elmsford, NY 10523

Dear Mr. Fuchs:

We are deeply troubled by reports that a massive, eight-month-long data breach impacted two of American Medical Collection Agency's (AMCA) partners, Quest Diagnostics Inc. and LabCorp, compromising the personal, financial, and medical information of a combined nearly 20 million patients.

Such breaches make private personal and financial information vulnerable to criminals, leading to potential identity theft and irreparable harm to their credit reports and financial futures. The potential exposure of a patient's private medical records presents additional challenges in which such information could be used against patients in a discriminatory manner.

Consumers should be able to have a reasonable expectation that, when they share their personal data with any company or its billing partner, such as AMCA, the data will be protected. Further, patients have a right to expect nothing more from laboratory testing than accurate results and a fair bill; a risk of identity theft should not be part of their testing experience.

We request information from your company to better understand how a breach of this magnitude occurred and the ultimate impact on patients. We must ensure that entities with access to patients' personal, medical, and financial information understand their heightened duty to protect both the patient and their sensitive information, and that your company is taking both immediate and long-term steps to mitigate any harm.

In light of these concerns, please provide responses to the following:

Provide a detailed timeline of the breach, including when it began, its discovery, any investigation of its scope and source, notification to authorities and regulators, notification to AMCA's senior executives, efforts to notify patients, and notification to both LabCorp and Quest Diagnostics's senior executives and boards of directors.
Please explain how the breach persisted for eight months without awareness from AMCA.
Is this the first data breach at AMCA? If not, please list the dates and duration of any prior data breaches. Please also describe any processes or standards the company implemented as a result of prior breaches.
Please describe AMCA's efforts to identify the scope of affected patients and breadth of information compromised.
Does this breach put any of AMCA's other partners at risk? If yes, which ones? What information has AMCA provided to its partners regarding the breach?
What steps has AMCA taken to identify and limit potential patient harm associated with this breach?
AMCA has informed LabCorp and Quest Diagnostics that it intends to offer the impacted patients identity protection and credit monitoring services for 24 months
Does AMCA plan to promote its paid services to these individuals at the end of the free two years?
Does AMCA plan to provide notice to each affected consumer, or will it rely on its partners to notify patients
Does AMCA have procedures in place to receive and act on vulnerability reports?
If so, please describe these procedures, when they were implemented, and how frequently the company acts to remediate vulnerabilities.
What new processes will AMCA implement to better monitor its information and data security?
Please describe the resources that AMCA dedicates to information and data security.
Does AMCA employ a Chief Information Security officer? If so, to whom does this person report?
Is anyone at AMCA responsible for evaluating the information and data security of its systems?
How many full-time employees at AMCA focus on information and data security?
10. During the period in which the breach occurred, how many times did AMCA conduct a security test to evaluate AMCA systems, and, if so, why did it fail to detect the breach? Has AMCA done one since, and what were the results?

We request that AMCA respond to this request no later than June 14, 2019. Thank you for your prompt attention to this important issue.

Sincerely,

Source