How Quest Diagnostics secures patient access to lab results with Incode
Sensitive results, an older patient base, and a verification step that had to work even for patients with no ID to scan. Knowledge-based questions could not carry it.
adult Americans rely on Quest each year
average cost reduction with Incode
faster patient onboarding
completion rate, a 25% increase
The lab results behind American care, behind one login
Quest Diagnostics delivers lab results to patients across the United States, with the MyQuest account as the front door.
MyQuest covers onboarding and account creation, lab-results access, account updates, and appointment scheduling. Each of those moments begins with verifying the patient, including patients with no ID to scan and no camera on hand.
What it takes to guard a patient's results
Behind the login sit a patient's diagnoses, genetic findings, and mental-health history: the data thieves pay the most for, and the hardest to put right once it leaks.
-
01
A breach here costs the most
The average healthcare data breach costs $7.42M, the costliest of any industry for 14 years running (IBM, 2025). U.S. regulators logged 725 large healthcare breaches in a single year (HHS OCR, 2024), and one 2024 breach alone exposed 192M people.
-
02
A stolen medical identity cannot be canceled
Unlike a card, it corrupts the record itself, so a patient can be misdiagnosed from a chart that no longer describes them. For Quest, the same failure means exposure under the Health Insurance Portability and Accountability Act (HIPAA) and lost trust.
-
03
The security quiz failed both ways at once
Quest's earlier control was knowledge-based authentication: quiz questions pulled from public and credit records. A fraudster buys old addresses and loan amounts from a breach and answers every question, while the real patient cannot recall a mortgage from decades ago and loses access to their own results.
The National Institute of Standards and Technology (NIST) no longer recognizes knowledge-based questions as an acceptable authenticator, and a document-only replacement would only move the barrier: many patients have no ID or camera on hand when they need care.
Verify against data first, ask for more only when needed
Quest replaced static questions with a layered check inside MyQuest, leading with the lightest step and adding assurance only when the risk earns it.
A passive first check, no document needed
Non-Doc Verification (KYC)
The first layer confirms the patient against authoritative data in the background. Nothing to photograph, no selfie, no upload, so most patients clear it in under 2 seconds. The patients that knowledge-based questions shut out now get straight to their results.
More assurance, only when it is earned
Identity Verification
When a signal calls for a closer look, the check steps up to a document scan with a selfie and passive liveness. The friction meets the risky cases and stays out of the way of a routine result.
Verified at every request
Access is re-established each time results are opened, so one past check never becomes a standing key to a patient's record.
The security quiz, retired
The layered model replaced knowledge-based authentication across MyQuest, retiring a quiz that fraudsters could look up and honest patients could not pass.
The layered check runs live across the MyQuest account, from onboarding and lab-results access to account updates and appointment scheduling.
How it works
Built for healthcare-grade security
HIPAA-compliant
Built to handle protected health information, with a Business Associate Agreement in place.
A dedicated environment
The deployment is single-tenant, isolated from every other Incode customer.
U.S. data residency
Hosted in a U.S. region and shaped to Quest's own security review.
Privacy is the architecture
Incode made privacy a founding conviction long before regulation or the market asked for it. Its AI-first identity verification reduces fraud while remaining private and compliant.
What's next
See how Incode verifies identity in healthcare
Secure enough for health data, open enough for the patients who need it.