Quest’s lab portal breach is a vendor-risk test. Check your exposure now
- Posted by Greg Wahlstrom, MBA, HCM
- Posted in Blog
Quest Diagnostics disclosed unauthorized access to a web portal clients use to order tests and view results, a reminder that patient data is only as secure as the vendors that hold it.
What happened
Quest said in a securities filing that on Oct. 21 it identified unauthorized access to Quanum Lab Services Manager (LSM), the web-based system physician practices and other clients use to place lab orders and retrieve results. The company paused access, brought in outside cybersecurity experts and notified federal law enforcement. It believes some patient records in the system were accessed, and its client notice says protected health information and identifying details may be involved. The scope is still being determined. Quest also paused two other client tools, Essential Insights and LabHQ, as a precaution, while stating that no data was accessed in them.
Quest says its core operations are running. Clients who order through direct lab-system interfaces or EHR connections were told to continue as usual. LSM users were directed to an alternate portal, faxed paper requisitions or phone requests for results. Quest says it will notify affected providers, health plans and patients once its investigation is complete.
Why it matters beyond one vendor
Most hospitals do not rely on LSM for inpatient work, but many employed physician groups, outreach labs, affiliated practices and clinically integrated networks do. Those users may now face manual workarounds, delayed results and, later, breach notices that patients will associate with their own doctors and health system.
The incident also fits a pattern. Over the past year, medical technology suppliers including Stryker and Boston Scientific have had attacks that halted ordering, manufacturing or shipping. Third-party platforms are now a leading route to patient data and a frequent source of operational disruption that the hospital does not control.
What to do this week
- Inventory exposure. Ask ambulatory, outreach and lab leaders which sites use LSM, Essential Insights or LabHQ, and whether any results are pending in those channels.
- Confirm the workaround. Make sure affected practices know the fax and phone fallback, and that results returned through alternate routes reach the chart and the ordering clinician.
- Prepare for notification. Have privacy and legal teams review your business associate agreement with Quest, clarify which entity is responsible for each data flow and draft patient-facing language now.
- Watch for follow-on fraud. Brief staff and patient call centers on phishing messages that reference lab results or the Quest incident.
- Raise the board question. Ask how many critical vendors hold patient data, when each was last assessed and how long clinical operations could continue if one went dark.
Executive takeaway: Treat the Quest incident as a live tabletop exercise: find every place your clinicians touch the affected tools, close gaps in result follow-up, and use it to press for a current, board-level view of third-party cyber risk.