Quest Diagnostics Pays $5M After Mixing Patient Medical Data With Hazardous Waste

Quest Diagnostics has agreed to pay almost $5 million to settle allegations it illegally dumped protected health information – and hazardous waste – at its facilities across California.

This sum won't hurt at all for the corporation, one of the largest clinical medical lab networks in the US. In all, Quest is being charged slightly less than two days of its $994 million annual profit in 2023 – hardly a serious disincentive.

Under the settlement [PDF], Quest will pay $3,999,500 to ten California counties (Alameda, Los Angeles, Monterey, Orange, Sacramento, San Bernardino, San Joaquin, San Mateo, Ventura, and Yolo), plus give $300,000 to environmental projects and an additional $700,000 to foot attorneys' fees and other costs. In exchange, it admits no guilt over the matter.

It also agreed to hire an independent environmental auditor to review waste-disposal practices at its facilities, and improve processes for handling, storage, and disposal of medical and hazardous waste – as well as personal health information – at four laboratories and more than 600 patient service centers in California.

Asked about the California settlement, Quest Diagnostics spokesperson Denny Moynihan told The Register on Thursday:

"Through our meticulous waste audits, it came to light that Quest Diagnostics may have encountered challenges in properly managing confidential patient data, medical waste, and hazardous materials," San Joaquin County district attorney Ron Freitas gushed.

"Our initial inquiry in San Joaquin County prompted us to engage with the attorney general's office and other relevant parties."

In total, the district attorneys' offices said they conducted more than 30 inspections of Quest labs and patient centers across California.

During those inspections, authorities dug through Quest's compactors and dumpsters, and said they found hundreds of containers of chemicals, as well as bleach, reagents, batteries, electronic waste, unredacted medical information, medical waste such as used specimen containers for blood and urine, and hazardous waste such as used batteries, solvents, and flammable liquids.

• Romanian hospital ransomware crisis attributed to third-party breach
• Ignore Uncle Sam's 'voluntary' cybersecurity goals for hospitals at your peril
• After injecting cancer hospital with ransomware, crims threaten to swat patients
• 'Scandal-plagued' data broker tracked visits to '600 Planned Parenthood locations'

This waste and data disposal broke hazardous waste law, California's Medical Waste Management Act, unfair competition law, and civil laws prohibiting the unauthorized disclosure of personal health information, prosecutors argued in their court submissions [PDF].

While improperly dumping hazardous waste can have terrible human health and environmental consequences, leaving people's personal records in places where identity thieves can pilfer them – even if they have to wade through bio-waste to get it – isn't particularly ideal, either.

It's bad enough that ransomware crews and other criminals are hitting healthcare facilities to steal protected health records, which can be extremely damaging to patients and organizations.

Monterey County district attorney Jeannine Pacioni commented optimistically: "This settlement will help ensure that patients' personally identifiable and private health information is protected and will protect worker safety and human health by ensuring that hazardous and medical wastes are properly managed and disposed of." ®