Quest Diagnostics, a New Jersey-based clinical laboratory company, said it has restored an online service doctors’ offices use to order lab tests and read results after an intruder accessed patient information. The company is still working out whose records were involved and what information was accessed.
The service, Quanum Lab Services Manager, connects medical offices with Quest’s laboratory services. Staff can use it to submit a test order, track its progress and look up the result. It also handles tasks such as ordering supplies and arranging collection of patient samples.
Quest learned of the unauthorized access on Oct. 21 and disclosed it in a Securities and Exchange Commission filing the following day. It said it had notified federal law enforcement and hired outside cybersecurity experts to help investigate and respond. The filing said Quest believed an unauthorized party had accessed some patient records, while the full extent of the access remained under investigation.
How the interruption affected medical offices
Quest paused access to Quanum after discovering the incident. It also temporarily suspended two other services, Essential Insights and LabHQ, as a precaution. Quest said no data was accessed in those two systems. The company has since restored all three services and said it has addressed the security incident.
Medical offices have other ways to send orders to Quest. Some use connections through their own electronic medical record systems or direct laboratory interfaces. Quest said those connections were unaffected and its operations and ability to serve patients had not been materially disrupted.
During the interruption, Quest directed Quanum users to another service, Quanum eLabs, or paper order forms. Medical offices could request results by phone or eFax.
Which patient records were accessed?
Quest’s incident notice and FAQs confirm that patient health or identifying information was involved. They do not specify the information accessed, how many people were affected or which providers’ patients were involved. The company has also not disclosed how the intruder gained access or whether records were copied out of the system.
Quest says it will notify affected patients and providers as required by law. Patient letters will explain available resources, including credit and identity monitoring. The company has not given a completion date for the investigation or a timetable for those letters.