Quest's breach last week is a symptom of a disease in healthcare: one centralized server, thousands of providers with access, and millions of patients records.

→ 2019: a billing-collections vendor was breached for 8 months. 11.9M Quest patients were exposed.

→ 2024: ransomware hit Synnovis, the pathology lab behind several London hospitals. Thousands of appointments and procedures were cancelled. A year later, King's College Hospital confirmed the attack contributed to a patient's death. One factor: a long wait for a blood test result.

→ Oct 21, 2026: Quest found unauthorized access to Quanum LSM, the platform doctors' offices use to order labs and see results. It shut the system down and told offices to use paper requisitions. It still hasn't said how many patients were affected.

In 2025, 697 large health data breaches were reported to HHS, affecting ~61M people. Healthcare has been the most expensive industry for breaches 14 years running: $7.42M per breach on average, and 279 days to identify and contain one (IBM).

When one system has access to everything, it becomes a major weakness. One breach & everything is gone.

Patient records aren’t eggs we should keep in one basket. I like seeing systems that keep data at the hospital.