University Hospitals disconnected its computer systems from the internet on Thursday after detecting unusual activity on its servers, and as of Friday morning, patients were still locked out of the MyChart portal. The Cleveland-based health system says digital-service disruptions could continue for several more days, though it maintains there has been no impact on patient care.
According to cleveland.com, University Hospitals disconnected its systems from the internet after unusual server activity was detected on October 22, and a spokesperson said the move was taken as a precaution. The health system has not identified all of the affected services or said whether patient information was accessed, the outlet reports. The University Hospitals website displayed a warning Friday that only limited services were available, and the MyChart patient portal appeared to remain unavailable that morning.
Fox 8 reports that University Hospitals said it is actively investigating and working with experts to determine the scope and impact of the incident on hospital and ambulatory operations, per a statement from the system. University Hospitals said there is currently no impact on patient care delivery, even as it works to pin down exactly which digital services were hit.
A Separate Breach at Quest Diagnostics
The timing has drawn attention because Quest Diagnostics, which offers outpatient laboratory services at University Hospitals locations, disclosed its own cybersecurity incident this month. The same cleveland.com report notes that University Hospitals has not confirmed whether its server incident is connected to the Quest Diagnostics breach, leaving the relationship between the two events unresolved.
Quest Diagnostics Chief Financial Officer Sam Samad said the company learned Wednesday of unauthorized access to Quanum Lab Services Manager, a test-ordering system used by certain clients who lack electronic medical records, the report states. Quest identified the affected system as Quanum LSM and said it paused access to it after discovering the incident. The company believes personal information and patient records were affected, though it has not determined which patients or what specific information was involved, according to the same report.
Samad said the incident, still in its early investigative stages, has not materially disrupted Quest's business operations or its ability to serve physicians and patients, per the outlet's account. He declined to provide additional details beyond that. Quest also temporarily paused access to its Essential Insights and LabHQ systems as a precaution, saying no data was accessed in either of those platforms.
What Quest and University Hospitals Are Telling Clients
Quest said it does not expect delays for clients who had not used Quanum LSM, since providers relying on electronic medical records or direct laboratory interfaces can keep ordering tests through unaffected connections. Clients who did use the affected system can instead turn to paper requisitions or Quest's eLabs system to place orders and retrieve results, per the report. Quest notified federal law enforcement and hired outside cybersecurity experts to assist with its investigation, according to a regulatory filing cited by the outlet.
Quest said it will notify affected patients as required by law and will provide them with information about resources including credit and identity monitoring. Cleveland19.com notes that Quest has faced breaches before: a 2016 incident exposed lab results and contact information for about 34,000 people, and a 2019 hack at a third-party debt-collection vendor, American Medical Collection Agency, affected personal information belonging to roughly 11.9 million Quest patients. HIPAA Journal similarly recounts that the 2018-2019 vendor breach exposed the protected health information of approximately 11.9 million Quest patients.
Legal Backdrop for Any Notification
Under the Ohio Revised Code, a person that owns or licenses computerized personal data must disclose a breach to affected Ohio residents, generally within 45 days. A custodian storing data on another's behalf must notify that person or a government entity expeditiously. Whether the University Hospitals incident triggers either duty remains unclear.
Healthcare has remained a heavy target for cyberattacks more broadly. A report attributed to the FBI lists 238 ransomware threats and 206 data-breach incidents. For now, University Hospitals patients are left checking whether MyChart has come back online, while Quest customers wait to learn if their own records were among those exposed.
