When you get blood work done, you expect your medical information to stay between you and the people responsible for your care. Quest Diagnostics is now investigating unauthorized access to a system that handles test orders and results, and it acknowledges that personal information and patient records were affected.
In its October 23 incident update, Quest says it paused access to Quanum Lab Services Manager after discovering the intrusion. Certain healthcare providers use the platform, also called Quanum LSM, to order tests, receive results, and look up patient information.
For patients, the biggest question is what someone accessed. Quest has not disclosed the specific information involved or how many people were affected. Its provider FAQ confirms that health information or personally identifiable information was involved, while its patient FAQ explicitly acknowledges that personal information and patient records were affected.
That leaves people in an uncomfortable position. Patients cannot tell from the announcement whether their own records were involved or what someone may have learned about them. The notice does not establish that every Quest patient was affected, and it would be wrong to suggest otherwise.
Quest says pausing Quanum LSM stopped the unauthorized access, and it is communicating with law enforcement. However, the company has not identified who was responsible or explained how the intruder gained access.
Other provider tools have gone offline as a precaution, too. Quest temporarily paused access to Essential Insights and LabHQ, although it says no data was accessed in those systems. Its core business operations remain running, and providers who order testing through direct laboratory information system connections or electronic medical record interfaces can continue using them.
Medical offices that normally rely on Quanum LSM have a few workarounds. Providers can submit paper requisitions, including by fax, or use Quanum eLabs to place orders and receive results. The affected portal is redirecting clients to eLabs, where Quest says they can sign in with their existing credentials.
Providers can request results through National Customer Services at 1-866-MYQUEST or through eFax. For help using eLabs, Quest lists its Connectivity Help Desk at 1-800-697-9302. The company does not expect delays for clients that have not used Quanum LSM.
Keeping testing available is necessary, but that addresses only part of the problem. A medical office may be able to submit an order through another system while a patient still faces uncertainty about who accessed their records.
Quest says it will notify affected patients, providers, and health plans, but it has not given a firm timeline for completing the investigation or sending those notices. Patient notification letters will describe available resources, including credit and identity monitoring.
Those services may offer some help, but they cannot undo the exposure of private medical information. You can replace a credit card number. You cannot replace your medical history, which is why a breach involving patient records deserves more than the usual assurances about taking security seriously.
The company also addresses a possible connection to a PHP security issue in its FAQ. Based on its investigation, Quest says this incident is unrelated, although it has not provided an alternative explanation for how the breach happened.
Patients deserve to know whose information was accessed, what it contained, and what Quest will change to prevent a repeat. Getting the portal back online will help medical offices return to their normal routines, but restoring confidence will require answers about what happened to the data entrusted to it.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
