Quest Diagnostics reports unauthorized access to lab system, says patient information may have been compromised
NEW JERSEY — Quest Diagnostics is investigating a cybersecurity incident involving unauthorized access to one of its laboratory management systems, acknowledging that some patient information, including protected health information and personally identifiable information, was accessed.
In an update issued Thursday, Oct. 22, at noon, Quest Diagnostics said the incident involved its Quanum Lab Services Manager system, which certain health care providers use to order laboratory tests and access patient results.
The company said it suspended access to the system after discovering the unauthorized activity and is continuing to investigate the extent of the breach.
“We have identified an incident involving unauthorized access to our Quanum Lab Services Manager (LSM) system, which certain clients use to place test orders, receive and look-up results. Upon discovery of the incident, we paused access to the system and we are continuing to investigate the incident. Our core business operations are not impacted and remain up and running,” Quest Diagnostics said in its statement.
According to the company, investigators believe some patient data within Quanum LSM was accessed, although the specific information affected has not yet been determined. Quest confirmed that the incident involved protected health information and personally identifiable information but did not specify how many patients or health care providers may have been affected.
Quest said it is working to identify impacted patients and providers and will issue notifications as required by applicable law. The company also confirmed that it has been communicating with appropriate law enforcement authorities.
Although the unauthorized access was limited to Quanum LSM, Quest temporarily suspended access to two other systems, Essential Insights and LabHQ, as a precaution. The company said no data was accessed in those systems.
Quest said its core laboratory operations remain operational and that providers who use direct laboratory information system interfaces or electronic medical records to order testing can continue using those services without interruption.
For health care providers who normally use Quanum LSM, Quest said alternative methods remain available to order tests and obtain results. These include paper requisitions, which can be faxed to Quest locations, and the company’s Quanum eLabs platform.
The company said Quanum LSM users are being redirected to Quanum eLabs, where they can sign in using their existing credentials to place orders and retrieve results. Providers may also contact Quest National Customer Services at 1-866-MYQUEST to request results by telephone or electronic fax.
Technical assistance for Quanum eLabs is available through the company’s Connectivity Help Desk at 1-800-697-9302.
Quest said it does not expect testing or reporting delays for clients who do not use Quanum LSM, noting that its other ordering interfaces and core business operations were not affected.
As of Thursday’s update, the company anticipated restoring full functionality to Quanum LSM as soon as Friday, Oct. 23, although it had not confirmed that the system was fully operational.
“We take privacy and security very seriously and are committed to full restoration of our systems as soon as possible,” the company said.
Quest also addressed questions about recent federal warnings concerning security vulnerabilities associated with the PHP programming language, saying its investigation found no connection between that issue and the unauthorized access to Quanum LSM.
The investigation remains ongoing, and Quest has not yet disclosed the total number of patients affected or the specific categories of information accessed.
Additional information is available on the Quest Diagnostics website.
