Quest Diagnostics learned on October 21 that an unauthorized party had accessed its Quanum LSM system, which some clients use to place laboratory test orders and retrieve results. In its October 22 SEC filing, the company says it believes “an unauthorized party accessed certain patient records.” It is investigating the full scope.
For a practice that uses Quanum LSM, the incident reaches a shared laboratory workflow carrying patient information. Quest says the intrusion has not materially disrupted its operations or its ability to serve patients. A functioning ordering service can still be part of a patient-data investigation.
Unauthorized access to Quanum LSM
Clients use Quanum LSM to place test orders, receive results and look them up. Check the application staff use for each Quest ordering and results connection, then mark the Quanum LSM connections in your laboratory integration inventory.
Quest describes unauthorized access to the system and a preliminary belief that patient records were accessed. Ask Quest for your client-specific scope and any entry-method findings as its investigation proceeds, before assigning a cause or telling patients their records were affected. For now, verify exposure through Quest’s answer for your account and your own inventory of Quanum LSM use.
Quest contains activity and investigates
Quest says it initiated its cybersecurity incident response procedures to contain the activity, determine its nature and scope, and implement remedial measures. It has notified federal law enforcement and brought in external cybersecurity experts. Quest’s investigation will determine the client-specific follow-up.
The continued availability of testing means a practice may have an ordinary queue of new orders and returned results at the same time it is assessing this incident. Route the security question to your Quest account owner and privacy or incident-response team while orders and results continue to flow.
Identify your Quanum LSM exposure
Start with the laboratory integration inventory and the staff workflow for placing Quest orders and retrieving results. Identify whether anyone at your organization uses Quanum LSM, then ask your Quest account or incident contact in writing whether your client account and its patient records fall within the accessed material. Request the relevant dates, record categories and any client-directed response steps as Quest establishes them. Keep Quest’s answer and subsequent notices with your incident record so the privacy team can decide what follow-up applies to your patients.
Use a client-specific written answer as the verification point: match the service Quest names against the application your staff uses, and record Quest’s finding for your account. Until Quest supplies that scope, treat the patient-record question as pending for your organization. Testing can continue while Quest determines which patient records were involved.