What AMCA Was

American Medical Collection Agency operated as part of Retrieval-Masters Creditors Bureau, Inc., a New York based operation. It specialized in medical debt collection for laboratories and diagnostic testing facilities, which is a narrower niche than general healthcare collection and one that concentrated enormous volumes of patient data in a single vendor.

That concentration is the first thing to understand about what followed. A laboratory processes tests for many providers and many patients, and a collection vendor serving several large laboratories sits downstream of all of them. AMCA held records on people who had never heard of it, from providers they had never chosen, on behalf of labs most of them could not name.

The company is no longer operating in its prior form, so this is a retrospective rather than a guide to dealing with an active agency. Anyone who received an AMCA notice years ago and is trying to resolve a balance today is most likely dealing with a different holder, since accounts were dispersed after the collapse.

What Happened

An unauthorized user had access to AMCA's internal system from August 1, 2018 through March 30, 2019, a window of roughly eight months.

The exposed data went beyond what most breaches involve. It included names, Social Security numbers, and payment card information, and in some instances the names of medical tests and diagnostic codes. That last category is what elevated the incident from a financial data breach to a health information breach, because a test name or diagnostic code can reveal a medical condition.

The client exposure was concentrated among the laboratories AMCA served. Quest Diagnostics reported approximately 11.9 million patients affected and LabCorp approximately 7.7 million, with additional clients bringing the total above 20 million people. State attorneys general later described the exposure as reaching at least 21 million Americans.

The Detection Failure

The most instructive detail is not the intrusion itself. It is that AMCA failed to detect it despite warnings from the banks that processed its payments.

Payment processors noticed indications of compromise and raised them. The intrusion nonetheless continued for months. That is a monitoring and incident response failure rather than a perimeter failure, and it is the kind of gap that a security assessment would surface and that a certification like SOC 2 is designed to test.

Eight months is a long time in breach terms. It is long enough for data to be exfiltrated at leisure, and it removes any argument that the exposure was a brief lapse.

The Collapse

AMCA filed for bankruptcy on June 17, 2019, citing the costs associated with responding to the breach.

Those costs are worth itemizing because creditors underestimate them. Notification to more than 20 million individuals. Credit monitoring. Forensic investigation. Legal defense across dozens of consolidated class actions. Regulatory investigations by multiple state attorneys general. And the immediate loss of the client relationships that constituted the business, because laboratories terminated their contracts.

A mid sized collection agency does not absorb that. The company that had been holding data on 20 million people ceased to be a going concern within roughly ten weeks of the disclosure.

For a provider, that raises a question the industry had not seriously asked before: what happens to your accounts, and your patients' data, when your vendor fails?

The Multistate Settlement

A coalition of 41 state attorneys general resolved their investigation through a settlement, with the effort led by Indiana, Texas, Connecticut, and New York. The Indiana and Texas offices also participated in the bankruptcy proceedings.

The New York Attorney General's announcement and parallel releases from other participating states, including Texas and North Carolina, set out the terms.

The remedial obligations describe, in effect, the security program the company should have had: create a written information security program, adopt an incident response plan, engage a third party to perform security assessments, and employ a qualified chief information security officer.

A $21 million payment to the states was included but suspended, contingent on the company's cooperation with the investigation and the accuracy of its representations about its assets. That structure reflects the reality that the entity had already collapsed, and it is a reminder that a settlement number is not the same as money recovered.

Why It Reset Vendor Diligence

Before AMCA, security posture was a checkbox in most healthcare collection vendor selections. After it, providers started asking substantive questions, and the ones worth asking came directly out of what went wrong.

Does the vendor maintain a written information security program, and who owns it? Is there a named chief information security officer or equivalent, or is security an additional duty for someone in IT?

Is there an incident response plan, and has it been tested? How quickly must the vendor notify you of a suspected incident, and is that timeframe in the contract rather than in a policy document?

Does an independent third party assess the vendor's controls, and will they share the report? SOC 2 Type II reporting is the common baseline, and HITRUST certification is the healthcare specific framework some agencies now carry.

What data does the vendor actually require, and does the placement file exceed it? The minimum necessary principle is a HIPAA requirement, and it is also the cheapest breach mitigation available, because data never transmitted cannot be exposed.

Is a business associate agreement executed before any protected health information moves, and does it obligate return or certified destruction at the end of the relationship?

Our full diligence list is in the medical collection agency vetting checklist, and our earlier company overview is in who is American Medical Collection Agency.

What Consumers Should Take From It

The uncomfortable structural fact is that you did not choose this vendor and could not have vetted it.

Your data reached AMCA because a laboratory you may never have interacted with directly placed an account, under a contract you never saw. That arrangement is standard across the industry, and it is why collection agency breaches affect people who have no relationship with the breached company.

If you are notified of any collection agency breach, the response is the same: place a fraud alert or, better, a credit freeze, which is free and blocks new accounts from being opened in your name. Take offered credit monitoring and actually read the reports. Pull your credit reports and look for accounts you did not open. Watch for tax related fraud, since Social Security numbers are used to file fraudulent returns. And be alert to follow on scams, because breach victim lists circulate and callers claiming to help are common.

Where medical test names or diagnostic codes were involved, the exposure is health information rather than only financial information, and that is not something monitoring addresses. It is a reason to take the notice seriously rather than filing it.

This was not an isolated event. Collection agencies continue to suffer significant breaches, including the incident disclosed by Receivables Performance Management affecting more than 3.7 million people. The medical debt landscape generally, including credit reporting rules and your dispute rights, is covered in special rules in medical debt collection.

The Lasting Point

AMCA is remembered as a breach story, and the more useful reading is that it was a vendor management story. A laboratory's patients were harmed by a company the patients never selected, chosen by a provider who had not verified its security, monitored by no one who acted on the warnings that arrived.

Every link in that chain was preventable, and each one is a question a provider can ask before signing.