Maryland’s Attorney General Frosh Announces Multistate Settlement with American Medical Collection Agency over 2019 Data Breach
BALTIMORE, MD – Maryland Attorney General Brian E. Frosh today announced that Maryland, as part of a coalition of 41 attorneys general, has reached a settlement with Retrieval-Masters Creditors Bureau, d/b/a American Medical Collection Agency. The settlement resolves a multistate investigation into the 2019 data breach that exposed the personal information of over 7 million individuals, including 285,108 Maryland residents, and potentially exposed the personal information of up to 21 million individuals throughout the United States.
Retrieval-Masters Creditors Bureau is a debt collection agency. Under the name American Medical Collection Agency (AMCA), the company specialized in small balance medical debt collection primarily for laboratories and medical testing facilities. An unauthorized user gained access to AMCA’s internal system from August 1, 2018, through March 30, 2019. AMCA failed to detect the intrusion, despite warnings from banks that processed its payments. The unauthorized user was able to collect a wide variety of personal information, including Social Security numbers, payment card information, and, in some instances, names of medical tests and diagnostic codes.
On June 3, 2019, AMCA provided notice to many states, and began providing notice to over 7 million affected individuals that included an offer of two years of free credit monitoring. On June 17, 2019, as a result of the costs associated with providing notification and remediating the breach, AMCA filed for bankruptcy.
“AMCA failed to protect the personal information of 7 million Americans,” said Attorney General Frosh. “The breach of highly sensitive personal information was due to AMCA’s lack of care.”
As part of the settlement, AMCA may be liable for a $21 million total payment to the states. Because of AMCA’s financial condition, that payment is suspended unless the company violates certain terms of the settlement agreement.
Under the terms of the settlement, AMCA and its principals have agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers. These include:
- Creating and implementing an information security program with detailed requirements, including an incident response plan;
- Employing a duly qualified Chief Information Security Officer;
- Hiring a Third-Party Assessor to perform an information security assessment; and,
- Cooperating with the attorneys general with investigations related to the data breach and maintaining evidence.
The states’ investigation was led by an Executive Committee including Maryland, Connecticut, Florida, Illinois, Indiana, Massachusetts, Michigan, New York, North Carolina, Tennessee and Texas. The settlement is joined by the attorneys general of Arizona, Arkansas, Colorado, the District of Columbia, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Louisiana, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, and West Virginia.
