Service returns before the investigation ends

Quest Diagnostics said in an October 23 evening update that it had restored Quanum Lab Services Manager and other systems paused during its response to unauthorized access. The company says it contained the intrusion, while continuing to determine which patients and information were affected. Quanum supports laboratory orders and access to results. Restoration therefore resolves an availability problem without completing the privacy investigation.

Keep the company’s statements distinct

Quest’s notice says core business operations were unaffected and direct customer laboratory-system and electronic-medical-record interfaces remained available. Its FAQs acknowledge access involving patient information, but do not provide a final affected-patient count. Quest says it will notify affected patients and providers. The company also says the incident is unrelated to the recently disclosed PHP issue. The Record’s October 23 reporting described the earlier interruption; the later company update is the basis for reporting restoration here.

A separate workstream for provider offices

Our analysis is that healthcare customers should track service recovery and data-exposure questions separately. An office can confirm that its authorized users can submit orders and retrieve results while maintaining a contact responsible for subsequent incident notices. Reconcile any work queued during the interruption through established clinical and administrative procedures, rather than assuming that a functioning login proves every pending task is complete. This is an operational recommendation, not evidence of missing or altered results at Quest.

Prepare answers without guessing the scope

Provider support staff also need a consistent way to handle questions that the investigation has not yet answered. Record the source and time of the latest supplier update, route patient-specific concerns to the appropriate privacy contact and avoid promising that an individual’s information was unaffected before confirmation. For technical teams, retain relevant account-support and access records under existing policies so later questions can be investigated. Do not place patient details in a general incident tracker to make coordination easier. A short status record can distinguish verified service availability, unresolved exposure questions and the owner of each follow-up. That approach supports continuity without presenting an ongoing investigation as closed. Quest directs customers needing credential-reset assistance to its IT Connectivity Help Desk through the official notice. Customers should use that established channel when resolving access problems, rather than relying on unsolicited messages that claim to provide a breach-related reset.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Healthcare
Suggest a correction →