Laboratory Medicine Consultants, Ltd.

Laboratory Medicine Consultants, LTD reported a data breach to the Oregon Attorney General. The breach was reported on 2019-07-25. The breach occurred during 3/21/2019. The breach was discovered on 5/15/2019. Notice was sent on 7/24/2019.

Laboratory Medicine Consultants, Ltd. reported to HHS on 2019-07-25 a Hacking/IT Incident affecting 144,775 individuals. Breached information located on Network Server. A business associate, American Medical Collection Agency, compromised its payment website, exposing patient PHI (demographic, clinical, financial). The CE ceased using the BA, notified individuals and HHS, and cooperated with OCR.

Laboratory Medicine Consultants, Ltd. notified patients of a data security incident involving its vendor, Retrieval Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). Unauthorized access occurred to AMCA's website payment page and database between August 1, 2018, and March 30, 2019. LMC was notified on May 15, 2019. Affected data may include names, addresses, phone numbers, dates of birth, dates of service, balance information, and treatment provider information. LMC ceased using AMCA and engaged cybersecurity experts.

Laboratory Medicine Consultants (LMC) notified Montana AG of a third-party vendor breach involving American Medical Collection Agency (AMCA). On May 15, 2019, LMC learned AMCA's database containing patient PII and health data was accessed. LMC engaged cybersecurity experts and terminated the vendor relationship. No misuse confirmed.

Laboratory Medicine Consultants (LMC) notified Washington AG of a data breach involving its business associate, American Medical Collection Agency (AMCA). Unauthorized access to an AMCA database on March 21, 2019, exposed patient PII (name, address, DOB, balance) and financial account data. LMC notified 684 Washington residents on July 24, 2019, and terminated its relationship with AMCA.

LABORATORY MEDICINE CONSULTANTS, LTD. filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-309). The register records the breach as discovered on March 21, 2019. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.