Quest Diagnostics Says an Intruder Reached Patient Records Through the Portal Doctors Use to Order Lab Tests
Quest Diagnostics told regulators that an unauthorized party got into Quanum Lab Services Manager, the platform some clients use to order tests and view results, and likely accessed certain patient records. Here is what the company has confirmed, what it has not, and what medical practices should do now.
Lab testing company Quest Diagnostics has disclosed a breach in a system that medical practices use to order tests and get results. Quest Diagnostics said it learned on Wednesday, October 21, of unauthorized access to Quanum Lab Services Manager (Quanum LSM), where certain clients place test orders and receive or look up results. In a filing with the Securities and Exchange Commission dated Thursday, the New Jersey company said it believes an unauthorized party accessed certain patient records.
This briefing draws on the Associated Press report published by SecurityWeek, Fox Business’s coverage and Quest’s Form 8-K.
What Quest has confirmed
- The system: Quanum LSM, a platform for ordering lab tests and retrieving results. Quest says it has stopped the unauthorized access and paused access to the platform while it works to restore it.
- The data: the company believes certain patient records were accessed. Fox Business reports Quest confirmed that patient health information or personally identifiable information was involved.
- The response: Quest activated its incident response procedures, notified federal law enforcement and brought in outside cybersecurity experts.
- Collateral pauses: as a precaution, Quest also paused its Essential Insights and LabHQ systems, saying no data was accessed on them, according to Fox Business.
- Operations: Quest says the incident has not materially disrupted its business or its ability to serve patients. Practices that use Quanum LSM can order through paper requisitions or the Quanum eLabs platform, and Quest does not expect testing delays for clients who do not use Quanum LSM.
- Restoration: Fox Business reports that Quest expects full functionality back as soon as Friday.
What is still unknown
- How many patients are affected, and which specific details were in the records that were viewed
- How the intruder got in, and whether a client account, a vendor or a software flaw was involved
- How long the access lasted before it was discovered
- Which practices’ patients are involved. Quest says it is working to identify affected patients and providers and will notify them as the law requires.
Quest told the AP the breach is not connected to PHP2Shell, the pair of PHP flaws that has drawn mass exploitation attempts this week.
Why the name sounds familiar
This is not Quest’s first data incident. According to the AP, lab results and contact information of about 34,000 people were exposed in a 2016 online breach, and in 2019 roughly 11.9 million Quest patients were caught up in the breach of the billing collections vendor American Medical Collection Agency. Quest has said its own systems were not involved in that one, Fox Business notes.
What this means for your company
If you run a medical, dental or specialty practice, the immediate job is practical: confirm with your Quest representative whether your office uses Quanum LSM, switch to the alternate ordering routes in the meantime, and watch for a notice about your patients. Keep a record of what you were told and when, because patient questions will follow. More broadly, every business depends on outside portals that hold its customers’ data. List the ones your staff log into, make sure each account uses multifactor authentication, remove access for people who have left, and know what your contracts say about who notifies whom after a breach. You cannot secure a vendor’s system, but you can control your side of the door.
Need help reviewing the vendor portals your staff use and the access controls around patient or customer data? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
