Clinical laboratory firm Quest Diagnostics Inc. said Monday that hackers have access to personal data on 11.9 million of its patients. Secaucus, New Jersey-based Quest said it has been informed by a billing collections provider, Elmsford, New York-based American Medical Collection Agency, which unauthorized user had access to AMCA's system containing personal information on the patients. AMCA provides billing collection services to a Quest contractor, Optum360, a unit of Minnetonka, Minnesota-based UnitedHealth Group.
The statement said Quest and Optum360 are working with forensics experts to investigate the matter. The said AMCA's first-reported Quest and Optum360 of potential unauthorized activity on AMCA's web payment page on May 1
On May 31, it reported that the data on affected system on AMCA's affected system included information regarding 11.9 million Quest patients, and that it includes this information includes personal information, including certain financial data, social security numbers and medical information, but not laboratory test results.
It said AMCA has not provided detailed or complete information about the incident, including which information of which has been affected and Quest has not been able to verify the information it has received from AMCA.
The statement said, "Quest is taking this matter very seriously and is committed to the privacy and security of our patient's personal information. Since learning of the AMCA data security incident we have suspended sending collection requests to AMCA. ”It said it is working with Optum360” to ensure that Quest patients are appropriately notified consistently with the law. We are committed to keeping our patients, health care providers, and all relevant parties informed as we learn more. ”UnitedHealthcare said in a statement,“ While Optum360 data systems were not impacted by this situation, data security is critically important to us, and we are working with Quest and AMCA to understand this issue and ensure appropriate actions are being taken. ”
Spokesmen for Quest and AMC did not immediately respond to requests for additional information.
In April, it was announced that Yahoo had settled over $ 117.5 million with millions of people whose email addresses and other personal information were stolen in the largest data breach in history.