Quest Diagnostics disclosed unauthorized access to a laboratory information system Thursday, raising fresh concerns about the security of patients’ medical records after earlier incidents exposed information involving millions of Americans.
The New Jersey-based laboratory company said it learned October 21 of unauthorized access to Quanum Lab Services Manager, a platform certain health care clients use to order laboratory tests and retrieve results. Quest believes an intruder accessed certain patient records, but it has not established which types of information the intruder viewed.
Quest said it launched its incident response procedures, notified federal law enforcement and engaged outside cybersecurity specialists. The company said the incident had not materially disrupted its business operations or its ability to serve patients. The company did not identify the number of affected patients or the data fields at issue.
Quest Has Faced Major Data Exposures Before
Quest has faced previous cybersecurity incidents. In 2016, an intrusion involving an online system exposed contact information and laboratory results concerning approximately 34,000 people, according to contemporaneous Associated Press coverage.
A much larger case emerged in 2019 when American Medical Collection Agency, a collections provider in Quest’s billing chain, told the company that its compromised system contained information about approximately 11.9 million Quest patients. The information potentially included financial data, Social Security numbers and medical information, but not laboratory test results, Quest said at the time. Quest cautioned that it could not independently verify the vendor’s initial figures.
The 2019 episode involved a contractor handling billing-related information. The newly disclosed incident concerns a platform for laboratory orders and results. Investigators have not identified a common cause or established that the same data categories were involved.
Major U.S. Laboratories And Their Security Records
Quest and Labcorp are among the country’s major national clinical testing companies. Sonic Healthcare USA, which includes Clinical Pathology Laboratories, also operates a large laboratory network. Hospitals and regional health systems run other major laboratories.
Labcorp also became entangled in the 2019 American Medical Collection Agency incident. State attorneys general said the contractor breach potentially exposed information concerning more than 27.5 million people across affected organizations, including 10.2 million Labcorp patients. The 27.5 million figure represents the broader event, not an additional Labcorp-only incident.
In September 2026, a bipartisan coalition of 44 state attorneys general settlement with Labcorp over that episode. The agreement requires stronger oversight of debt collectors, information-security safeguards, vendor assessments and breach-response measures. Michigan’s attorney general also described a separate $35 million Labcorp class-action settlement tied to the case.
“Companies can contract with vendors freely and delegate authority, but data security is a non-delegable duty,” Illinois Attorney General Kwame Raoul said in a September 24 counted 663 breaches affecting at least 500 individuals that occurred during 2024, compared with 732 during 2023. The 2024 events collectively affected approximately 242.9 million people, though a single patient can appear in more than one incident count.
Hacking and other information-technology incidents accounted for 81% of the 2024 large breaches, according to HHS. The figures span health insurers, providers and business associates, not laboratories alone.
One of the largest examples involved Change Healthcare, a claims and payment technology company rather than a diagnostic laboratory. A 2024 cyberattack disrupted medical billing and other services; HHS later put the number of affected individuals at approximately 192.7 million.
What Patients Should Know Now
Laboratory and billing records may contain identifying information, physician details, test-related information and financial data. Quest has not publicly specified the fields in the records involved in this week’s intrusion. It also has not established whether the intruder copied, altered or misused any of the information.
Stolen medical information can enable fraudulent claims, unexpected collection demands or erroneous entries in a person’s medical history. The Federal Trade Commission identifies those outcomes as risks of medical identity theft, not as confirmed consequences of the Quest incident.
People who receive a breach notice should read it carefully, verify communications through Quest’s official channels and review insurance explanations of benefits for unfamiliar services.
Patients who find suspicious medical charges or records can contact the provider or insurer and seek recovery guidance through IdentityTheft.gov. A credit freeze may help if an incident exposes information useful for opening financial accounts, but it does not stop every form of medical identity theft.
The Questions Quest Still Must Answer
Federal HIPAA rules generally require covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a reportable breach of unsecured protected health information. The rules also establish reporting duties to HHS, including faster reporting for incidents affecting at least 500 individuals. Whether and how those provisions apply will depend on the facts Quest establishes during its investigation.
Quest’s assessment that it can continue serving patients addresses laboratory operations. It does not yet answer the privacy concerns raised by the intrusion.
Provided by Dallas Express
