On October 26, Quest Diagnostics reported that it had remediated a cybersecurity incident and restored Quanum Lab Services Manager (LSM), the online system some healthcare providers use to order laboratory tests and retrieve results. The company is still investigating the extent of unauthorized access and has not disclosed how many patients were affected or which specific data fields were involved. For practices that use Quanum LSM, the immediate task is to confirm that laboratory workflows are functioning properly, reconcile any activity handled through temporary alternatives, and understand how Quest will communicate findings about potentially affected patient information.
What Quest Has Confirmed
Quest disclosed in a Form 8-K filed with the Securities and Exchange Commission that it learned of unauthorized access to Quanum LSM on October 21. The company initiated its incident-response procedures, notified federal law enforcement, and engaged outside cybersecurity experts. The platform is used by certain clients to place test orders and receive or look up results. After discovering the incident, Quest paused access to Quanum LSM. The company said the incident had not materially disrupted its core business operations.
Quest subsequently reported that Quanum LSM had been restored. Two other systems, Essential Insights and LabHQ, which were temporarily paused as a precaution, were also restored. Quest said no data had been accessed in those two systems. The company has acknowledged that personal information and patient records were involved in the Quanum LSM incident. However, it has not identified the specific information accessed or disclosed the number of affected patients. The investigation remains ongoing, and Quest says it will notify patients and providers determined to be affected and report to relevant regulatory authorities as required by applicable law.
Quest has also stated that providers using direct laboratory information system (LIS) interfaces or electronic medical records (EMRs) to order testing were not affected by the incident. Practices should distinguish this statement about ordering systems from a determination of whether their own patients’ information was involved.
What Practices Should Check Now
Restoration of the platform does not, by itself, confirm that every order, result, or follow-up handled during the interruption has been reconciled. Practices that used Quanum LSM should review the following areas.
1. Reconcile orders placed during the interruption.
Identify orders submitted through temporary alternatives, including paper requisitions or Quanum eLabs. Confirm that each intended test was received and processed. Check for missing, duplicated, or still-pending orders before resubmitting anything.
2. Review outstanding results and follow-up.
Identify tests ordered before or during the interruption whose results were not yet documented in the patient’s chart. Confirm that results have been received, reviewed by the responsible clinician, and acted on when necessary. Pay particular attention to abnormal or time-sensitive findings and document any follow-up that remained outstanding during the disruption.
3. Confirm that current workflows are working as expected.
Ask the staff who place orders and retrieve results whether they can access Quanum LSM and complete their usual tasks. If the practice uses an EMR or direct LIS interface instead, confirm that the interface is operating normally. Escalate unresolved access or workflow issues through the practice’s established Quest support channel.
4. Follow Quest’s credential guidance and watch for phishing.
Quest advises clients who need assistance resetting Quanum LSM credentials to contact its IT Connectivity Help Desk at 1-800-697-9302. The company has also warned about phishing and voice-phishing attempts related to the incident. Remind staff to verify unexpected communications through established contacts and avoid unsolicited links.
5. Establish whether Quest considers the practice or its patients affected.
Contact the appropriate Quest representative if the practice needs clarification about its account, the scope of the incident, or the process for receiving notifications. Ask how Quest will notify affected providers and health plans, what information it expects to provide, and whether any action is required from the practice. Do not assume that the absence of an individual notice means the investigation has conclusively ruled out an impact.
6. Keep a record of the practice’s response.
If staff used alternative ordering or results procedures, retain the relevant logs and document how outstanding work was reconciled. Record any access issues, unresolved orders, patient-care follow-up, and communications with Quest. This creates a clear account of the practice’s operational response if questions arise later.
HIPAA: Do Not Assume Every Practice Has the Same Notification Obligation
The HIPAA Breach Notification Rule applies to breaches of unsecured protected health information (PHI). In general, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a reportable breach. Business associates must notify the covered entity when a breach occurs at or through the business associate.
Quest has stated that it will make notifications required by applicable law and will notify patients and healthcare providers determined to have been affected. Whether a particular practice has separate obligations depends on the facts, the information involved, the practice’s role, and applicable federal and state requirements.
A practice should not conclude that it must independently notify every patient simply because it orders tests through Quest. Nor should it assume that Quest’s investigation automatically resolves every compliance question for the practice. If the organization receives an incident notice or has evidence that its own systems or patient information were involved, its compliance officer or legal counsel should assess the applicable duties and deadlines.
What Providers Should Take Away
Quanum Lab Services Manager has been restored, but the investigation into the information accessed is not complete. The immediate priority for practices that used the system is operational: reconcile orders and results handled during the interruption, confirm that clinical follow-up is complete, and obtain clarification from Quest when necessary.
Until Quest releases further findings, providers should avoid assumptions about the number of patients affected or the exact information involved. Keeping reliable records of orders, results, and follow-up is the most useful step a practice can take now while the scope of the incident remains under investigation.
Sources
- Quest Diagnostics. Quanum incident notice and FAQs.
- U.S. Securities and Exchange Commission. Quest Diagnostics Form 8-K, October 22, 2026.
- Becker’s Hospital Review. Quest restores lab ordering platform as patient data probe continues, October 2026.
- U.S. Department of Health and Human Services. HIPAA Breach Notification Rule.
Discover more from Doctor Trusted
Subscribe to get the latest posts sent to your email.
