Class Action Lawsuit Filed in Midst of Quest Diagnostics Data Breach

A California man has filed a class action lawsuit over the Quest Diagnostics data breach.  Plaintiff Edgar Gutierrez alleges that his personal information became exposed because he was a Quest patient.

Nearly 12 million patients may have had their personal information compromised, according to USA Today. Quest has reportedly confirmed that one of its billing collection services was exposed to an unauthorized user between August 2018 and March 2019, which it believes resulted in the breach. The news has spawned other lawsuits.

Though Quest’s databases were not compromised, third parties who do Quest’s billing collections were.

The named defendants in Gutierrez’s complaint include Quest Diagnostics, billing collections vendor American Medical Collection Agency (AMCA), and Quest’s revenue cycle management provider Optum 360. The companies are accused of failing to take proper safety protocols that would have prevented the breach.

Overview of Quest Diagnostics Data Breach

In early June, the Security and Exchange Commission (SEC) received a filing about the Quest Diagnostics data breach, which stated that AMCA and Optum360 had notified the diagnostic testing provider of the incident.

AMCA and Optum360 have since estimated that about 11.9 million Quest patients likely had their personal information compromised. The personal information included:

• Financial Data
• Social Security Numbers
• Medical Information (other than lab results)

Quest Diagnostics is one of the world’s largest diagnostic testing companies and performs a multitude of services that help physicians  diagnose disease. The company’s website says that more than 200,000 physicians rely on Quest’s lab tests, which also allow medical professionals to share clinical information and securely prescribe medications.

According to the SEC filing, an unauthorized user hacked into AMCA’s system, which stored data from Quest and other medical companies, including LabCorp. The breach reportedly occurred between Aug. 01, 2018, and March 20, 2019.

Gutierrez’s class action lawsuit says that for seven months hackers had access to his and others’ personal information yet the defendants failed to notify the victims.

The complaint alleges that Gutierrez and proposed Class Members were not notified of the Quest Diagnostics security breach until June 3, 2019 — nearly a year after it began — despite the company knowing about it since at least May 14, 2019.

In a statement, Quest indicated that AMCA had not yet provided sufficient details about what personal information was hacked, including the names of the patients affected.

The lawsuit notes that the Health Insurance Portability and Accountability Act (HIPPA), and other industry standards, require companies maintain a sufficient security system for patient data.

Quest and the other companies had obligations to Gutierrez and other class members to ensure their personal information would be safe, according to suit, and the plaintiff had no reason to believe otherwise.

AMCA has said the breach is being investigated by third party security experts.

Gutierrez and other class members are seeking damages for negligence, failure to implement proper technological safety protocols and for failing to promptly notify patients.

This Quest Data Breach Class Action Lawsuit is Gutierrez v. American Medical Collection Agency Inc., Case No. 7:19-cv-05212, in the U.S. District Court of the Southern District of New York.

The TCA AMCA Data Breach Investigation is now open! If you were a patient at LabCorp, Quest, or another lab, and received notice that you were affected, submit your information here.

Join a Free Quest Diagnostics Data Breach Lawsuit Investigation

If you are a Quest Diagnostics patient and you received bills from AMCA, you may qualify to join this Quest Diagnostics data breach class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.