16 ms·

Quest Diagnostics says nearly 12M patients may have had data breached

163 points by pgrote 7y ago

folkhack 7y ago
Great. Yet another one. Can't even just get simple lab diagnostics anymore without having your SSN/CC number harvested... let's all look on in disbelief while these people barely get slapped on the wrist! Just a reminder to everyone to keep passwords rotated, and to monitor your credit/bank account...
- pmoriarty 7y ago
  How many more decades of such data breaches is it going to take for organizations to start realizing that SSN's are not a good way to authenticate or identify people (a purpose they were never meant for), and that most people's SSN's have already been compromised?
  - bifrost 7y ago
    There are very few common identity factors available for these companies. I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose.
    - bluGill 7y ago
      It would have the same issues as SSN though: a number that once it leaks lets someone else have too much knowledge/power over you.
      - DebtDeflation 7y ago
        But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.
        ravenstine 7y ago
        > one time use "credit card numbers" generated at the time of the transaction PayPal used to have that feature but got rid of it for some reason.
        bifrost 7y ago
        AMEX did too, I think the problem is the keyspace is small enough that it would be a serious problem.
        beamatronic 7y ago
        Discover had that for a while, many years ago.
        u801e 7y ago
        Capital One still has this feature for online transactions.
        Consultant32452 7y ago
        Google Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.
        Gibbon1 7y ago
        If the healthcare industry used medical id numbers instead of SSN's that would help. Better banks should be forced to stop using SSN's completely. And forced to use 2factor. Preferably both.
        nkrisc 7y ago
        And this is a function of power asymmetry. Why is it my problem that a bank issued a credit card to some guy in Romania or Russia who said they were me? It should be their problem unless they can prove it was me who opened the account. But they make it my problem through the enormous power they wield over our ability to participate in society. If they come looking for the money I supposedly owe them on that account, I should be able to tell them to fuck off and collect from whoever they sent the card to of their own volition. If they can't figure out whose business they took, maybe they need to reconsider their practices, otherwise they're just giving away money.
      - devereaux 7y ago
        There is absolutely no technical reason why it should be the case if done properly. With SIM cards or other hardware devices, your private key is never leaked (if "done properly") With cryptos like BTC, you can generate many keys from one source of entropy, and treat them as disposable. I don't see why medical records couldn't be encrypted with a disposable key, given by a hardware device which stores the seed, and only linked to the matching public key.
      - whack 7y ago
        I wonder if it makes sense for the government (or private sector) to develop an official identity database and provide identity-as-a-service. One which has a public "username" that is unique/permanent and can be freely given out - a private "key"/password that you should never ever hand out to anyone - and physical offices that you can go to with your passport and other evidence, in order to change your password when needed. You could then develop apps or APIs on top of this, in order to authenticate your identity whenever requested by a 3rd party.
        bifrost 7y ago
        I suspect that won't happen with private industry because its unlikely to have a cost advantage and it wouldn't be mandatory.
        kaybe 7y ago
        In Germany we have identity-as-a-service provided by post offices. You go there with an ID and the form and they send that form with confirmation to where it is needed. It's quite commonly used to open an account with an online bank, for example. https://de.wikipedia.org/wiki/Postident https://de.wikipedia.org/wiki/Postident (And I just see that the service is also offered by mailman as well, so they can come to you. Austria and Switzerland have similar services.) edit: It's quite remarkable how sometimes people online say there should be something, and I'm like, yeah, we have that.. I wonder if it works the other way too. Probably.
        maxheadroom 7y ago
        In Sweden, we have one as well but organised by the banks, called BankID[0]. There used to be an open-source client[1] for it but it looks dead, now. [0] - https://en.wikipedia.org/wiki/Electronic_identification#Sweden https://en.wikipedia.org/wiki/Electronic_identification#Swed... [1] - https://git.fribid.se/fribid/ https://git.fribid.se/fribid/
      - bifrost 7y ago
        If it was separate from your SSN it could only be used for medical records tracking, thus not used for credit things. The SSN isn't supposed to be used for tracking, but it is anyways...
        freehunter 7y ago
        Exactly. At work I generate different API keys for different purposes, so when/if one gets compromised I can shut it off and generate a new one without all the integrations breaking. Right now SSN is the government's admin/root API key. One compromise and it's game over. But if my medical ID got stolen I could turn it off and get a new one without invalidating my passport and disqualifying me from a car loan and locking me out of my college transcripts etc.
        FireBeyond 7y ago
        Rightly or wrongly, abuse case - drug seeker. Go to doctor, get narcotic prescription. Get new medical ID, go to new doctor, repeat.
        bluGill 7y ago
        no, that doesn't solve anything. I could get a new SSN (I can't, but you can imagine I could), but then I need to update everyone who has my old SSN. Your scheme is the same, except slightly less people to notify.
    - dragonwriter 7y ago
      > I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose. That (along with standard identifiers for health plans and providers, which survived as requirements) was originally part of HIPAA, though it was stripped out.
  - mgkimsal 7y ago
    8
  - SpikeDad 7y ago
    It wasn't for identification. It was for financial purposes so that the collection agency could find the people. Never the less it's inexcusable to keep such PIs in an open database without encryption and tight controls. I'm sure they allowed anyone in the company to browse peoples personal info so the leaches could go out to suck blood.
- hurrdurr2 7y ago
  I'm just going to assume that I've already been pwned. It's why I froze all five credit agency accounts & signed up for a credit monitoring agency via work.
  - folkhack 7y ago
    This is really where it's at. I've got monitoring and am considering the freezing route too. I just never open lines of credit (maybe one every 3-4 years) so it's like why have it open in the first place...!?
- SpikeDad 7y ago
  Just to clarify it wasn't Quest that has the compromise, it was a 3rd party collection agency which Quest sold their delinquent accounts. Quest doesn't store SSNs but the 3rd party evidently did as part of their efforts to identify people so they can collect. That company needs a massive fine and being forced to offer free credit monitoring for LIFE for anyone so compromised.
  - FireBeyond 7y ago
    Where did the third party get the SSNs from if not from Quest, who may not have been "storing" them (permanently), but sufficiently to make sure their collectors could utilize them.
    - SpikeDad 7y ago
      Quest doesn't ask for SSN - I use them for my lab tests. If you're a collection agency you're going to be getting financial records which are going to include SSN (I assume from the financial reporting agencies) and your job is to connect them to the names of delinquent Quest customers. So Quest has pretty much no blame here - it's the collection agencies that are allowed to buy people's financial records which include SSNs that are the bad guys here.
helloworld 7y ago
The breach came from American Medical Collection Agency, a debt collector that Quest uses. It's a sad statement on the state of American healthcare that 11.9 million people can't afford to pay their lab bills.
- bifrost 7y ago
  They use them for billing, Medical Billing is incredibly broken so most companies outsource it.
- smt88 7y ago
  I was able to (and did) pay my $20 lab fee a few years ago, but the billing entity sent it to collections anyway. It took me many months to get it removed from my credit report. That we have so much fallibility in medical billing is still a sad statement, though.
  - toomuchtodo 7y ago
    Collections PSA: Collections is regulated under FDCPA/FCRA. If you as a reader are in a similar situation, please review the the below resources. Do not tolerate misreporting of information to CRAs (credit reporting agencies) by creditors, nor pursuit by collections firms. Do not communicate with phone calls or use apps to dispute. Do use certified mail return receipt for correspondence while building your paper trail. Do demand validation of an alleged debt in a timely fashion. Do file a CFPB complaint and/or consult with an attorney to sue a debt collector when warranted. https://www.reddit.com/r/personalfinance/wiki/collections https://www.reddit.com/r/personalfinance/wiki/collections https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r... (excellent resource by patio11 on how to present to CRAs and build a paper trail, although more focused on responding to identify theft) https://web.archive.org/web/20190604005100/https://www.ballardspahr.com/~/media/files/alerts/2013-07-11-cfpbletters.pdf https://web.archive.org/web/20190604005100/https://www.balla... (Sample letters to respond to debt collectors) Disclaimer: Not an attorney, not your attorney.
    - 7y ago
clarkmoody 7y ago
Hey, maybe we shouldn't centralize huge amounts of sensitive information?
- bifrost 7y ago
  The US Govt wants to federalize this, think about how much worse it could've been.
  - freehunter 7y ago
    The government is far from perfect but private corporations have not exactly proven to be great stewards of data privacy or fiscal responsibility.
    - bifrost 7y ago
      Yeah, that OPM hack was greaaaaaaat....
ohithereyou 7y ago
Nobody should be allowed to hold this amount of sensitive information about customers without paying a large bond to hold that information. It's clear that these companies will not minimize their data collection since storage is practically infinite, so make it cost them so they have an actual reason to care.
JumpCrisscross 7y ago
Is this a HIPAA violation?
- bifrost 7y ago
  Its a breach, so yeah. That said it'll probably get covered by insurance...
  - olliej 7y ago
    If it is a HIPPA violation the fines are deliberately per instance - eg 12 million * (the fine), and I can’t recall whether hippa considers each piece of data a separate violation. But I think to be a HIPPA violation it would need to have information about what tests are involved - eg just a monetary debt and knowing it came from a lab might be argued as not being a violation? That said until there are mandatory per-person-per-data-leaked fines, coupled with liability for misuse of that data, companies are just going to continue leaking because they “compensate” people by giving them “free” credit monitoring. That last bit is great because it only resolves financial service harm, and offloads actually preventing fraud to the victims of these companies.
devereaux 7y ago
Name + ICD diagnosis, what a wonderful leak for blackmailers wordwide! (/s) Seriously, these two pieces of data that are innocent alone, when taken separately (HIV, chlamydia, cancer...) should NEVER have been linked together, ESPECIALLY when given to a third party, EVEN MORE stored together. I pray it will result in many lawsuits with hefty punitive damages, and that as a consequence private data will be considered a liability to be deleted as early as possible (just like corporate email in many companies)
- erentz 7y ago
  Insurance won't cover tests without the "allowed" ICD codes for it. It's silly and just another part of the bureaucracy making things inefficient.
  - devereaux 7y ago
    (see my comment suggesting disposable keys, like for crypto wallets: https://news.ycombinator.com/item?id=20088758 https://news.ycombinator.com/item?id=20088758 ) If the "allowed" ICD code is linked to the public key, or in the worst case if the patient provides the disposable private key to the insurance for verification (along with PCI like rules forbidding this key to be stored, like credit card expiration date if I remember correctly) this couldn't happen. It is gross negligence to keep these things together for longer than they need to be. Private data should be seen as a liability.
- tedmiston 7y ago
  Good catch. Reading between the lines I took this to mean that lab information was not leaked: > The system contained sensitive data, including credit card numbers, bank account information, medical information and Social Security numbers, Quest said. Lab results were not provided to AMCA and were not exposed in the breach. AMCA thinks 11.9 million Quest patients were affected as of May 31, 2019, Quest said. But it only says lab results were not leaked with the extremely generic label of medical information as being leaked. I wonder if "medical information" includes lab codes or what exactly it consists of?
mycall 7y ago
Nice, just went there today. Good job Quest!
pcarolan 7y ago
I tried dealing with Quest recently and gave up. They don't answer their phone or do and hang up. The more I see these breeches, the more it seems like it mostly comes down to someone either implicitly or explicitly making the decision that the costs of customer service (which includes data privacy) aren't worth it.
social_quotient 7y ago
Imagine the call fraud now. Hello Mrs Jones I’m calling about the labs you had done last month, CBC, cardiac panel etc., with Dr Bob. I was alerted to make the call because your values are out of normal range and there are critical things I need to review with you. Before we get in to the details I need to first confirm your identity. —- Or — Your insurance only covered part of the blood labs on the 12th. To release the results to you doctor I need to secure payment today for 189.74.
Terretta 7y ago
In the past I've done software for healthcare, happened to learn for the privacy conscious: You can order anonymous labs for yourself through various online lab resellers. At the lab, you don't need ID, just the order. You will get lab results; you will not get a diagnosis. For instance, and not a recommendation: FAQ: https://www.health-tests-direct.com/frequently-asked-questions https://www.health-tests-direct.com/frequently-asked-questio... Q: How can I keep my “true” identity from HTD, and the clinic, and the lab? A: Easy -- Don’t give us your phone number or credit card info. Then mail us a money order (a money order does not require your name or signature) for the total amount due for the blood draw and lab analysis. We will e-mail the lab paperwork to you when the money order arrives and email the lab results to you the same day we receive those 2-3 days later. If you want, you can even set up a temporary (and free) “alias” e-mail address at Yahoo! (e.g.,“YourAliasName”@yahoo.com) for the purpose of our email communications with you... There are two more things we hope that you will feel more comfortable knowing: First, 99.99% of the blood draw centers we send you to will NOT ask for your photo I.D. when you go in for your blood test. And, in the very-very rare event that one should they do so, don’t feel obligated to show it to them. Instead, leave the PSC and immediately call us. We will find you another PSC! Or, keep in mind, that your lab tests results are NEVER sent to or shared with the clinic or its personnel that does your blood draw. Only YOU get your lab results, and NOBODY else. So, if you are asked, and you DO decide to show them your drivers license or other ID, rest assured that they will NEVER see or know the result of your test(s) anyway! See also: https://www.walkinlab.com/help-contents#privacy https://www.walkinlab.com/help-contents#privacy Q - Can I do anonymous testing? A - Yes, an order can be placed anonymously. The First Name field must start with an alpha or numeric character and the Last Name must be an alpha character. Your correct date of birth and gender are required. Both of these work with LabCorp and Quest Diagnostics, DuckDuckGo can help you find more.
reiderrider 7y ago
We send a few thousand life insurance applicants per year to Quest. Quest is the 800 pound gorilla for insurance exam lab work. It’s unfortunate, but alternatives are likely less secure and we’ll continue using Quest.
rgray805 7y ago
Curious - who are are the possible "third party forensics firms" that would investigate this?
wiseleo 7y ago
Quest is one of leading providers of employment and pre-employment drug testing. Their "customers" do not have much choice to avoid them. They are often not "patients" in need of medical care. The tests are often paid for by interested parties like employers. Now I have to assume that because of a drug test required for my background checks, my identity was compromised yet again. Which politician can make ID data breaches financially ruinous and their concealment criminal?

163 points by pgrote 7y ago

Great. Yet another one. Can't even just get simple lab diagnostics anymore without having your SSN/CC number harvested... let's all look on in disbelief while these people barely get slapped on the wrist! Just a reminder to everyone to keep passwords rotated, and to monitor your credit/bank account...

pmoriarty 7y ago
How many more decades of such data breaches is it going to take for organizations to start realizing that SSN's are not a good way to authenticate or identify people (a purpose they were never meant for), and that most people's SSN's have already been compromised?
- bifrost 7y ago
  There are very few common identity factors available for these companies. I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose.
  - bluGill 7y ago
    It would have the same issues as SSN though: a number that once it leaks lets someone else have too much knowledge/power over you.
    - DebtDeflation 7y ago
      But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.
      - ravenstine 7y ago
        > one time use "credit card numbers" generated at the time of the transaction PayPal used to have that feature but got rid of it for some reason.
        bifrost 7y ago
        AMEX did too, I think the problem is the keyspace is small enough that it would be a serious problem.
        beamatronic 7y ago
        Discover had that for a while, many years ago.
        u801e 7y ago
        Capital One still has this feature for online transactions.
        Consultant32452 7y ago
        Google Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.
      - Gibbon1 7y ago
        If the healthcare industry used medical id numbers instead of SSN's that would help. Better banks should be forced to stop using SSN's completely. And forced to use 2factor. Preferably both.
      - nkrisc 7y ago
        And this is a function of power asymmetry. Why is it my problem that a bank issued a credit card to some guy in Romania or Russia who said they were me? It should be their problem unless they can prove it was me who opened the account. But they make it my problem through the enormous power they wield over our ability to participate in society. If they come looking for the money I supposedly owe them on that account, I should be able to tell them to fuck off and collect from whoever they sent the card to of their own volition. If they can't figure out whose business they took, maybe they need to reconsider their practices, otherwise they're just giving away money.
    - devereaux 7y ago
      There is absolutely no technical reason why it should be the case if done properly. With SIM cards or other hardware devices, your private key is never leaked (if "done properly") With cryptos like BTC, you can generate many keys from one source of entropy, and treat them as disposable. I don't see why medical records couldn't be encrypted with a disposable key, given by a hardware device which stores the seed, and only linked to the matching public key.
    - whack 7y ago
      I wonder if it makes sense for the government (or private sector) to develop an official identity database and provide identity-as-a-service. One which has a public "username" that is unique/permanent and can be freely given out - a private "key"/password that you should never ever hand out to anyone - and physical offices that you can go to with your passport and other evidence, in order to change your password when needed. You could then develop apps or APIs on top of this, in order to authenticate your identity whenever requested by a 3rd party.
      - bifrost 7y ago
        I suspect that won't happen with private industry because its unlikely to have a cost advantage and it wouldn't be mandatory.
      - kaybe 7y ago
        In Germany we have identity-as-a-service provided by post offices. You go there with an ID and the form and they send that form with confirmation to where it is needed. It's quite commonly used to open an account with an online bank, for example. https://de.wikipedia.org/wiki/Postident https://de.wikipedia.org/wiki/Postident (And I just see that the service is also offered by mailman as well, so they can come to you. Austria and Switzerland have similar services.) edit: It's quite remarkable how sometimes people online say there should be something, and I'm like, yeah, we have that.. I wonder if it works the other way too. Probably.
        maxheadroom 7y ago
        In Sweden, we have one as well but organised by the banks, called BankID[0]. There used to be an open-source client[1] for it but it looks dead, now. [0] - https://en.wikipedia.org/wiki/Electronic_identification#Sweden https://en.wikipedia.org/wiki/Electronic_identification#Swed... [1] - https://git.fribid.se/fribid/ https://git.fribid.se/fribid/
    - bifrost 7y ago
      If it was separate from your SSN it could only be used for medical records tracking, thus not used for credit things. The SSN isn't supposed to be used for tracking, but it is anyways...
      - freehunter 7y ago
        Exactly. At work I generate different API keys for different purposes, so when/if one gets compromised I can shut it off and generate a new one without all the integrations breaking. Right now SSN is the government's admin/root API key. One compromise and it's game over. But if my medical ID got stolen I could turn it off and get a new one without invalidating my passport and disqualifying me from a car loan and locking me out of my college transcripts etc.
        FireBeyond 7y ago
        Rightly or wrongly, abuse case - drug seeker. Go to doctor, get narcotic prescription. Get new medical ID, go to new doctor, repeat.
      - bluGill 7y ago
        no, that doesn't solve anything. I could get a new SSN (I can't, but you can imagine I could), but then I need to update everyone who has my old SSN. Your scheme is the same, except slightly less people to notify.
  - dragonwriter 7y ago
    > I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose. That (along with standard identifiers for health plans and providers, which survived as requirements) was originally part of HIPAA, though it was stripped out.
- mgkimsal 7y ago
  8
- SpikeDad 7y ago
  It wasn't for identification. It was for financial purposes so that the collection agency could find the people. Never the less it's inexcusable to keep such PIs in an open database without encryption and tight controls. I'm sure they allowed anyone in the company to browse peoples personal info so the leaches could go out to suck blood.
hurrdurr2 7y ago
I'm just going to assume that I've already been pwned. It's why I froze all five credit agency accounts & signed up for a credit monitoring agency via work.
- folkhack 7y ago
  This is really where it's at. I've got monitoring and am considering the freezing route too. I just never open lines of credit (maybe one every 3-4 years) so it's like why have it open in the first place...!?
SpikeDad 7y ago
Just to clarify it wasn't Quest that has the compromise, it was a 3rd party collection agency which Quest sold their delinquent accounts. Quest doesn't store SSNs but the 3rd party evidently did as part of their efforts to identify people so they can collect. That company needs a massive fine and being forced to offer free credit monitoring for LIFE for anyone so compromised.
- FireBeyond 7y ago
  Where did the third party get the SSNs from if not from Quest, who may not have been "storing" them (permanently), but sufficiently to make sure their collectors could utilize them.
  - SpikeDad 7y ago
    Quest doesn't ask for SSN - I use them for my lab tests. If you're a collection agency you're going to be getting financial records which are going to include SSN (I assume from the financial reporting agencies) and your job is to connect them to the names of delinquent Quest customers. So Quest has pretty much no blame here - it's the collection agencies that are allowed to buy people's financial records which include SSNs that are the bad guys here.

helloworld 7y ago

The breach came from American Medical Collection Agency, a debt collector that Quest uses. It's a sad statement on the state of American healthcare that 11.9 million people can't afford to pay their lab bills.

bifrost 7y ago
They use them for billing, Medical Billing is incredibly broken so most companies outsource it.
smt88 7y ago
I was able to (and did) pay my $20 lab fee a few years ago, but the billing entity sent it to collections anyway. It took me many months to get it removed from my credit report. That we have so much fallibility in medical billing is still a sad statement, though.
- toomuchtodo 7y ago
  Collections PSA: Collections is regulated under FDCPA/FCRA. If you as a reader are in a similar situation, please review the the below resources. Do not tolerate misreporting of information to CRAs (credit reporting agencies) by creditors, nor pursuit by collections firms. Do not communicate with phone calls or use apps to dispute. Do use certified mail return receipt for correspondence while building your paper trail. Do demand validation of an alleged debt in a timely fashion. Do file a CFPB complaint and/or consult with an attorney to sue a debt collector when warranted. https://www.reddit.com/r/personalfinance/wiki/collections https://www.reddit.com/r/personalfinance/wiki/collections https://www.kalzumeus.com/2017/09/09/identity-theft-credit-reports/ https://www.kalzumeus.com/2017/09/09/identity-theft-credit-r... (excellent resource by patio11 on how to present to CRAs and build a paper trail, although more focused on responding to identify theft) https://web.archive.org/web/20190604005100/https://www.ballardspahr.com/~/media/files/alerts/2013-07-11-cfpbletters.pdf https://web.archive.org/web/20190604005100/https://www.balla... (Sample letters to respond to debt collectors) Disclaimer: Not an attorney, not your attorney.
  - 7y ago

clarkmoody 7y ago

Hey, maybe we shouldn't centralize huge amounts of sensitive information?

bifrost 7y ago
The US Govt wants to federalize this, think about how much worse it could've been.
- freehunter 7y ago
  The government is far from perfect but private corporations have not exactly proven to be great stewards of data privacy or fiscal responsibility.
  - bifrost 7y ago
    Yeah, that OPM hack was greaaaaaaat....

ohithereyou 7y ago

Nobody should be allowed to hold this amount of sensitive information about customers without paying a large bond to hold that information. It's clear that these companies will not minimize their data collection since storage is practically infinite, so make it cost them so they have an actual reason to care.

JumpCrisscross 7y ago

Is this a HIPAA violation?

bifrost 7y ago
Its a breach, so yeah. That said it'll probably get covered by insurance...
- olliej 7y ago
  If it is a HIPPA violation the fines are deliberately per instance - eg 12 million * (the fine), and I can’t recall whether hippa considers each piece of data a separate violation. But I think to be a HIPPA violation it would need to have information about what tests are involved - eg just a monetary debt and knowing it came from a lab might be argued as not being a violation? That said until there are mandatory per-person-per-data-leaked fines, coupled with liability for misuse of that data, companies are just going to continue leaking because they “compensate” people by giving them “free” credit monitoring. That last bit is great because it only resolves financial service harm, and offloads actually preventing fraud to the victims of these companies.

devereaux 7y ago

Name + ICD diagnosis, what a wonderful leak for blackmailers wordwide! (/s) Seriously, these two pieces of data that are innocent alone, when taken separately (HIV, chlamydia, cancer...) should NEVER have been linked together, ESPECIALLY when given to a third party, EVEN MORE stored together. I pray it will result in many lawsuits with hefty punitive damages, and that as a consequence private data will be considered a liability to be deleted as early as possible (just like corporate email in many companies)

erentz 7y ago
Insurance won't cover tests without the "allowed" ICD codes for it. It's silly and just another part of the bureaucracy making things inefficient.
- devereaux 7y ago
  (see my comment suggesting disposable keys, like for crypto wallets: https://news.ycombinator.com/item?id=20088758 https://news.ycombinator.com/item?id=20088758 ) If the "allowed" ICD code is linked to the public key, or in the worst case if the patient provides the disposable private key to the insurance for verification (along with PCI like rules forbidding this key to be stored, like credit card expiration date if I remember correctly) this couldn't happen. It is gross negligence to keep these things together for longer than they need to be. Private data should be seen as a liability.
tedmiston 7y ago
Good catch. Reading between the lines I took this to mean that lab information was not leaked: > The system contained sensitive data, including credit card numbers, bank account information, medical information and Social Security numbers, Quest said. Lab results were not provided to AMCA and were not exposed in the breach. AMCA thinks 11.9 million Quest patients were affected as of May 31, 2019, Quest said. But it only says lab results were not leaked with the extremely generic label of medical information as being leaked. I wonder if "medical information" includes lab codes or what exactly it consists of?

mycall 7y ago

Nice, just went there today. Good job Quest!

pcarolan 7y ago

I tried dealing with Quest recently and gave up. They don't answer their phone or do and hang up. The more I see these breeches, the more it seems like it mostly comes down to someone either implicitly or explicitly making the decision that the costs of customer service (which includes data privacy) aren't worth it.

social_quotient 7y ago

Imagine the call fraud now. Hello Mrs Jones I’m calling about the labs you had done last month, CBC, cardiac panel etc., with Dr Bob. I was alerted to make the call because your values are out of normal range and there are critical things I need to review with you. Before we get in to the details I need to first confirm your identity. —- Or — Your insurance only covered part of the blood labs on the 12th. To release the results to you doctor I need to secure payment today for 189.74.

Terretta 7y ago

In the past I've done software for healthcare, happened to learn for the privacy conscious: You can order anonymous labs for yourself through various online lab resellers. At the lab, you don't need ID, just the order. You will get lab results; you will not get a diagnosis. For instance, and not a recommendation: FAQ: https://www.health-tests-direct.com/frequently-asked-questions https://www.health-tests-direct.com/frequently-asked-questio... Q: How can I keep my “true” identity from HTD, and the clinic, and the lab? A: Easy -- Don’t give us your phone number or credit card info. Then mail us a money order (a money order does not require your name or signature) for the total amount due for the blood draw and lab analysis. We will e-mail the lab paperwork to you when the money order arrives and email the lab results to you the same day we receive those 2-3 days later. If you want, you can even set up a temporary (and free) “alias” e-mail address at Yahoo! (e.g.,“YourAliasName”@yahoo.com) for the purpose of our email communications with you... There are two more things we hope that you will feel more comfortable knowing: First, 99.99% of the blood draw centers we send you to will NOT ask for your photo I.D. when you go in for your blood test. And, in the very-very rare event that one should they do so, don’t feel obligated to show it to them. Instead, leave the PSC and immediately call us. We will find you another PSC! Or, keep in mind, that your lab tests results are NEVER sent to or shared with the clinic or its personnel that does your blood draw. Only YOU get your lab results, and NOBODY else. So, if you are asked, and you DO decide to show them your drivers license or other ID, rest assured that they will NEVER see or know the result of your test(s) anyway! See also: https://www.walkinlab.com/help-contents#privacy https://www.walkinlab.com/help-contents#privacy Q - Can I do anonymous testing? A - Yes, an order can be placed anonymously. The First Name field must start with an alpha or numeric character and the Last Name must be an alpha character. Your correct date of birth and gender are required. Both of these work with LabCorp and Quest Diagnostics, DuckDuckGo can help you find more.

reiderrider 7y ago

We send a few thousand life insurance applicants per year to Quest. Quest is the 800 pound gorilla for insurance exam lab work. It’s unfortunate, but alternatives are likely less secure and we’ll continue using Quest.

rgray805 7y ago

Curious - who are are the possible "third party forensics firms" that would investigate this?

wiseleo 7y ago

Quest is one of leading providers of employment and pre-employment drug testing. Their "customers" do not have much choice to avoid them. They are often not "patients" in need of medical care. The tests are often paid for by interested parties like employers. Now I have to assume that because of a drug test required for my background checks, my identity was compromised yet again. Which politician can make ID data breaches financially ruinous and their concealment criminal?