F500 Pharma & Health Services · Health Care: Pharmacy and Other Services · Data breach
Quest Diagnostics
Headline
The AMCA breach is the cleanest illustration in this tracker of harm arriving through an entity the patient never chose and never heard of.
The AMCA breach is the cleanest illustration in this tracker of harm arriving through an entity the patient never chose and never heard of. American Medical Collection Agency was a billing collections vendor, not a lab - and its payment portal was compromised from August 1, 2018 to March 30, 2019, exposing roughly 11.9 million Quest patients. Across all its clients the total reached at least 20 million people, including names, addresses, dates of birth, Social Security numbers, financial information and medical information. Then AMCA itself filed for bankruptcy, which is the part with teeth: the entity actually responsible collapsed, taking most practical avenues of recovery with it. You cannot sue a company out of existence twice.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. amcadatabreachsettlement.com/ — Verified - primary source confirmed.
Terms
Arbitration
As of 2026 the official AMCA settlement website lists settlements only with LabCorp (see that row) and with Sonic Healthcare USA and affiliated labs, and notes there 'may be future settlements' with other defendants. No Quest settlement is listed, so Quest's portion of this shared litigation had not reached the same resolution stage.
Data sharing
ONE OF THE LARGEST MEDICAL LAB BREACHES IN HISTORY: Quest Diagnostics' billing vendor, American Medical Collection Agency (AMCA), suffered a breach (Aug 2018-March 2019) exposing personal AND FINANCIAL data — bank account information, credit card numbers, Social Security numbers, and medical information — of approximately 12 MILLION Quest patients; combined with the SAME AMCA breach affecting LabCorp (this same tab) and other labs, the TOTAL affected across all AMCA clients reached roughly 25 MILLION people (HIPAA Journal provisional total of about 24.9 million across 23 healthcare organizations), making this one of the largest healthcare-billing-related breaches ever recorded. SEPARATELY, in an earlier, distinct incident (Nov. 26, 2016), an unauthorized party accessed Quest's own 'MyQuest by Care360' internet application, exposing names, dates of birth, phone numbers and lab results — including HIV test results for some patients — of about 34,000 patients; a $195,000 class-action settlement received final approval on Feb. 25, 2020, offering up to $250 for documented losses plus up to $75 for patients whose HIV results were exposed (HIPAA Journal).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. The AMCA breach is the cleanest illustration in this tracker of harm through an entity the patient never chose. | characterization | n/a | none recorded |
| 2. American Medical Collection Agency was a billing collections vendor, not a lab. | fact | unknown | none recorded |
| 3. AMCA's payment portal was compromised from August 1, 2018 to March 30, 2019. | fact | supported | none recorded |
| 4. Roughly 11.9 million Quest patients were exposed. | fact | unsupported | 1 (0 confirmed) |
| 5. Across all AMCA clients the total reached at least 20 million people. | fact | unsupported | 1 (0 confirmed) |
| 6. The data included names, addresses, dates of birth, SSNs, financial and medical information. | fact | unsupported | none recorded |
| 7. AMCA's parent filed for bankruptcy. | fact | unsupported | 1 (0 confirmed) |
| 8. The responsible entity dissolved, taking most practical avenues of recovery with it. | fact | contradicted | none recorded |
| 9. You cannot sue a company out of existence twice. | characterization | n/a | none recorded |
0 of 9 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| none | Claim 4 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 5 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| court · 2023-10-16 | Claim 7 | Unassigned | corrected | “AMCA to file a Chapter 11 bankruptcy petition ... on June 17, 2019” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy questdiagnostics.com/home/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service questdiagnostics.com/home/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://amcadatabreachsettlement.com/ Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.