Quest’s lab portal breach is a vendor-risk test. Check your exposure now
Quest Diagnostics disclosed unauthorized access to a lab ordering portal. Here is how hospital leaders should check their exposure and prepare.
Quest Diagnostics disclosed unauthorized access to a web portal clients use to order tests and view results, a reminder that patient data is only as secure as the vendors that hold it.
Quest said in a securities filing that on Oct. 21 it identified unauthorized access to Quanum Lab Services Manager (LSM), the web-based system physician practices and other clients use to place lab orders and retrieve results. The company paused access, brought in outside cybersecurity experts and notified federal law enforcement. It believes some patient records in the system were accessed, and its client notice says protected health information and identifying details may be involved. The scope is still being determined. Quest also paused two other client tools, Essential Insights and LabHQ, as a precaution, while stating that no data was accessed in them.
Quest says its core operations are running. Clients who order through direct lab-system interfaces or EHR connections were told to continue as usual. LSM users were directed to an alternate portal, faxed paper requisitions or phone requests for results. Quest says it will notify affected providers, health plans and patients once its investigation is complete.