By Sean Orr, M.D. | November 1, 2026 | Florida Doctor Magazine
On Wednesday, October 21, Quest Diagnostics found that someone outside the company had gotten into Quanum Lab Services Manager, the web portal many of our offices use to order tests and look up results. Quest now believes certain patient records were accessed. Eleven days later, the company still has not said whose records, how many, or which fields. If your practice orders from Quest, as many Florida practices do, here is what we know and what I would do this week.
What Happened
Quest disclosed the incident in a Form 8-K filed with the Securities and Exchange Commission on October 22. According to that filing and the company’s online notice, Quest detected unauthorized access to Quanum Lab Services Manager (LSM) on October 21, shut off access to the platform, and as a precaution paused two other client tools, Essential Insights and LabHQ, which it says were not accessed. Quest activated its incident response plan, brought in outside cybersecurity experts and notified federal law enforcement.
The company says the accessed data includes protected health information or personally identifiable information, but it has not yet determined which data elements were involved or how many patients and providers are affected. Practices that receive results through a direct laboratory interface or their EMR were not affected, and Quest says its core testing operations were not materially disrupted. While LSM was down, Quest pointed clients to paper requisitions and its Quanum eLabs platform. Quest has since reported that LSM, Essential Insights and LabHQ have all been restored.
No criminal group had publicly claimed the attack as of the most recent reporting. At least seven proposed class actions, including Johnson v. Quest Diagnostics and Luciano v. Quest Diagnostics, were filed in federal court in New Jersey on October 22 and 23. Some of the complaints allege that names, dates of birth, insurance details and lab results were exposed; those are allegations, and Quest has not confirmed them. Quest has been here before. The largest earlier incident came in 2019, when a breach at its billing collection vendor, American Medical Collection Agency, exposed data on about 11.9 million Quest patients.
Why It Matters for Florida Physicians
The legal duty to notify patients sits with Quest in the first instance. As a clinical laboratory, Quest is a covered entity under HIPAA, and the Breach Notification Rule (45 C.F.R. § 164.404) requires it to notify affected individuals without unreasonable delay and no later than 60 days after discovery, which puts the outside date at December 20. Florida’s Information Protection Act (section 501.171, Florida Statutes) adds a requirement to notify the Florida Attorney General within 30 days when 500 or more Floridians are affected, with one 15-day extension available for good cause.
That does not leave our offices out of it. Patients who receive a Quest letter will call the doctor who ordered the test, because that is the name they recognize. If your practice has a separate business associate agreement with Quest, for example for EHR or billing services, the rules are different: a business associate must notify the covered entity within 60 days under 45 C.F.R. § 164.410, and your attorney should look at whether any of the exposed data was held for you. Every office also carries the downstream risk: stolen portal data is exactly what criminals use to write convincing phishing emails that look like they come from your lab.
What You Can Do This Week
- Find out whether your practice used Quanum LSM. Ask your office manager and your Quest account representative which ordering route you use. If everything flows through an EMR interface, your exposure through this incident is lower, although your patients’ Quest records may still be involved.
- Reset every Quanum credential. Change all staff passwords, remove accounts for anyone who has left the practice, turn on multifactor authentication wherever Quest offers it, and change the password anywhere a staff member reused it.
- Warn your staff about phishing. Expect emails, texts and calls claiming to be Quest that ask for logins, payment or patient details. Staff should verify any such request by calling a number they already have on file, never one supplied in the message.
- Pull your agreements with Quest. Check whether you have any business associate agreement with Quest, then ask Quest in writing whether your patients are affected and when you will be told. Record the inquiry and the response in your HIPAA security incident log. None of this constitutes legal advice, so bring in your health care attorney if anything in the agreement suggests a notification duty falls on your practice.
- Check your cyber insurance policy. Many policies require prompt notice of a vendor incident that could produce a claim. A short email to your broker now costs nothing.
- Give your front desk a script. A calm, accurate answer prevents panic: Quest had a security incident in its ordering portal, Quest is investigating, and Quest will notify affected patients directly by mail.
- Raise vendor security with your colleagues. Quest joins Stryker, Boston Scientific, CareCloud and McKesson on this year’s list of health care companies hit by cyberattacks. Ask your county medical society and the Florida Medical Association to push for vendor contracts with firm breach notification timelines and security disclosures written in.
What to Tell Your Patients
Patients should watch their mail for a letter from Quest and enroll in any credit or identity monitoring the company offers. They should read every explanation of benefits from their insurer and report any test or service they did not receive, because medical identity theft tends to show up there before anywhere else. A free credit freeze with Equifax, Experian and TransUnion is reasonable for anyone worried about their Social Security number, even though Quest has not said whether those numbers were involved. Anyone who finds fraud can report it and get a recovery plan at IdentityTheft.gov. Above all, patients should not give information to anyone who calls them claiming to be Quest; they should hang up and call the number on their Quest bill or the Quest website.
The Bigger Picture
We do not control the security of the labs, billing companies and device makers our practices depend on, but our patients hold us responsible for them anyway. That is an argument for physicians to have a stronger voice in how these vendors are chosen, contracted and held accountable. Every agreement we sign with a lab or software vendor should spell out how quickly they will tell us about a breach and what they will do for our patients when it happens. Organized medicine is the right place to set that expectation, and this incident is a good reason to start.
Frequently Asked Questions
Was my practice’s data exposed in the Quest Diagnostics breach?
Quest has not yet said which practices or patients were affected. The incident involved the Quanum Lab Services Manager portal, so practices that used that portal are the ones most likely to be involved. Practices connected only through an EMR or a direct laboratory interface were not affected, according to Quest.
Do Florida physicians have to notify patients about the Quest breach?
In most cases the duty to notify belongs to Quest, which is itself a HIPAA covered entity and has said it will notify affected patients and providers. If your practice has a separate business associate agreement with Quest, review it with your health care attorney.
How long does Quest have to notify patients in Florida?
HIPAA requires notice without unreasonable delay and no later than 60 days after discovery, which makes December 20, 2026 the outside date for a breach discovered on October 21. Florida law also requires notice to the Florida Attorney General within 30 days if 500 or more Floridians are affected.
Is Quanum LSM safe to use again?
Quest has reported that LSM is restored. Before your staff log back in, reset their passwords, remove old accounts and turn on multifactor authentication where it is available.
What should patients do if they think their Quest data was exposed?
They should watch for a notice from Quest, accept any monitoring offered, review insurance statements for services they never received, and consider a free credit freeze. Fraud can be reported at IdentityTheft.gov.
This article is general information for physicians and is not legal advice. Consult a Florida health law attorney about your practice’s specific obligations.
This article was drafted with the assistance of AI writing tools, then reviewed, edited, and approved by Dr. Sean C. Orr, M.D., who holds full editorial responsibility for its content. Illustration created with AI image tools.
References
- Quest Diagnostics, Form 8-K, Item 1.05 Material Cybersecurity Incidents (filed October 22, 2026). Quest investor relations
- Quest Diagnostics, “Quanum Lab Services Manager notice” (updated October 2026). questdiagnostics.com
- TechCrunch, “Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach” (October 23, 2026). techcrunch.com
- BleepingComputer, “Quest Diagnostics confirms data breach exposed patient records” (October 23, 2026). bleepingcomputer.com
- Fox Business, “Quest Diagnostics confirms patient information accessed in cyberattack, systems temporarily shut down” (October 22, 2026). foxbusiness.com
- The HIPAA Journal, “Patient Data Likely Accessed in Quest Diagnostics Hack” (October 23, 2026). hipaajournal.com
- Becker’s Hospital Review, “Quest restores lab ordering platform as patient data probe continues” (October 26, 2026). beckershospitalreview.com
- Top Class Actions, “Quest Diagnostics faces multiple class action lawsuits over lab data breach” (October 28, 2026). topclassactions.com
- 45 C.F.R. § 164.404, Notification to individuals. law.cornell.edu
- 45 C.F.R. § 164.410, Notification by a business associate. law.cornell.edu
- Florida Statutes § 501.171, Security of confidential personal information. flsenate.gov
- Federal Trade Commission, IdentityTheft.gov. identitytheft.gov