Quest Diagnostics said an unauthorized party accessed certain patient records through Quanum LSM, an online system that some of its clients use to order lab tests and to receive and look up results, according to a Form 8-K filed Thursday with the U.S. Securities and Exchange Commission. The company learned of the access Oct. 21 and has not said how many patients were affected or what information was exposed. For health care organizations, the case shows how a portal that links outside users directly to a lab's results can become a path to sensitive records.
What Happened
Quest said in the filing that it learned Oct. 21 of unauthorized access to Quanum LSM, which the company describes as a system "certain clients use to place test orders, receive and look up results." In plain terms, it is the channel through which those clients send test requests to Quest and get the answers back.
The company said it believes the unauthorized party accessed certain patient records. It did not give a number of patients, describe the types of data involved or explain how the intruder gained access. Quest said the full scope remains under investigation.
According to the filing, Quest started its cybersecurity incident response procedures to contain the activity, brought in outside cybersecurity experts and notified federal law enforcement. The company said the incident has not materially disrupted its business operations or its ability to serve patients. The filing does not say whether the unauthorized access has been stopped.
Why It Matters
Lab results are among the most sensitive records a health system holds, and an ordering portal is built to give many outside users routine access to them. When such a system is breached, the exposure can extend to patients of every practice that uses it, and those practices may have to answer their own patients' questions before the lab has finished its count.
Quest reported the incident under Item 8.01 of Form 8-K, a catch-all section for other events, rather than Item 1.05. Under rules the SEC adopted in 2023, Item 1.05 is the section for cybersecurity incidents a company has determined to be material, and that filing is generally due four business days after the determination. Quest's filing does not say whether the company has made a materiality determination. Its statement that operations were not materially disrupted addresses business continuity, not the significance of the data exposure.
For boards and executives at health care providers, the filing is a prompt to ask which vendor portals their staff use to send patient information out and pull results in, who can log in to them, and how quickly the provider would hear about a compromise on the vendor's side.
What to Watch
The next disclosures should answer the open questions: how many patients were affected, which categories of information were viewed or taken, and how the intruder reached Quanum. If the records include unsecured protected health information, federal HIPAA rules require notice to affected individuals without unreasonable delay and no later than 60 calendar days after a breach is discovered, subject to limited exceptions.
Also watch whether Quest files an amended 8-K, including under Item 1.05 if it later determines the incident is material, and whether clients that use Quanum receive their own notices from the company.
