Quest Diagnostics announced yesterday that it is investigating an unauthorized third-party intrusion into an internet application on its network. The company provided notice to individuals whose accounts have been affected.
Quest annually serves one in three adult Americans and half the physicians and hospitals in the United States, and has 43,000 employees
On November 26, 2016 an unauthorized third party accessed the MyQuest by Care360® internet application and obtained Protected Health Information (PHI) of approximately 34,000 individuals.
The accessed data included name, date of birth, lab results, and in some instances, telephone numbers. The information did not include Social Security numbers, credit card information, insurance or other financial information. There is no indication that individuals’ information has been misused in any way.
When Quest Diagnostics discovered the intrusion, it immediately addressed the vulnerability. Quest is taking steps to prevent similar incidents from happening in the future, and is working with a leading cybersecurity firm to assist in investigating and further evaluating the company’s systems. The investigation is ongoing and the unauthorized intrusion has been reported to law enforcement.
Quest Diagnostics has notified affected individuals via mail and established a dedicated toll-free number to call with questions regarding this incident. The number is (888) 320-9970, and can be reached Monday through Friday between 9:00 a.m. and 7:00 p.m. Eastern Time.
In February 2015, Anthem made history when 78.8 million of its customers were hacked. It was the largest health care breach ever, and it opened the floodgates on a landmark year. More than 113 million medical records were compromised last year, according to the Office of Civil Rights (OCR) under Health and Human Services.
And this year will be a record breaker for hacking.
As required by section 13402(e)(4) of the HITECH Act, the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. These breaches are now posted in a new, more accessible format that allows users to search and sort the posted breaches. By clicking the “Breach Submission Date” button on the top of the list, the breaches will be listed in reverse date order with the most recent shown at the top.
This HHS list shows 297 health information data breaches in 2016 as of December 7. Both large and small providers are listed.
Noteworthy California hacks include Kaiser Permanente Health Plan Inc, of both Northern and Southern California. It reports being hacked on November 11, 2016 as a result of unauthorized access of a network server. The USC Keck and Norris Hospitals reported a network server hack on September 21, 2016.