Quest Diagnostics breach exposes patient records via lab ordering system

Quest Diagnostics discovered unauthorized access to its Quanum Lab Services Manager on October 21, 2026, and filed a Form 8-K with the U.S. Securities and Exchange Commission the following day. The Quanum Lab Services Manager is the portal that certain healthcare clients — including doctors' offices, hospitals, and clinics — use to place laboratory test orders and retrieve results. The company believes certain patient records were accessed, though the full scope and number of affected individuals remain under investigation.

The types of data potentially involved include patient names, Social Security numbers, medical information, test orders, and health insurance details, though Quest has not yet confirmed which specific fields were reached. The company says its core business operations were not materially disrupted, and other ordering systems that were paused as a precaution have since been restored. Federal law enforcement has been notified, and outside cybersecurity experts are assisting with the investigation.

For healthcare organizations and any clinic that uses the Quanum platform to order tests, this incident has direct compliance consequences. Under HIPAA's breach notification rule, a covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. With the discovery date confirmed as October 21, that outer deadline falls around December 20, 2026. Quest has not yet announced a notification date or offered credit monitoring to affected patients. Healthcare clients may want to confirm which of their patients use Quest for lab work and review any business associate agreements in place, even though Quest, as the covered entity holding the records, carries the primary notification obligation.