How Quest Diagnostics secures patient access to lab results with Incode
Quest Diagnostics, the lab provider 1 in 3 adult Americans rely on each year, uses Incode identity verification to confirm patients inside the MyQuest account. A passive check against authoritative data clears most patients in under 2 seconds, and a document scan with a selfie is requested only when the risk calls for it. Quest reports 5x faster patient onboarding, a 98% completion rate, and a 50% average cost reduction.
adult Americans rely on Quest each year
average cost reduction with Incode
faster patient onboarding
completion rate, a 25% increase
The lab results behind American care, behind one login
Quest Diagnostics delivers lab results to patients across the United States, with the MyQuest account as the front door.
MyQuest covers onboarding and account creation, lab-results access, account updates, and appointment scheduling. Each of those moments begins with verifying the patient, including patients with no ID to scan and no camera on hand.
Every MyQuest moment, from account creation to opening a lab result, starts by verifying the patient. That identity verification step is what keeps sensitive results guarded while staying open to patients with no ID to scan or camera on hand.
What it takes to guard a patient's results
Behind the login sit a patient's diagnoses, genetic findings, and mental-health history: the data thieves pay the most for, and the hardest to put right once it leaks.
-
01
A breach here costs the most
The average healthcare data breach costs $7.42M, the costliest of any industry for 14 years running (IBM, 2025). U.S. regulators logged 725 large healthcare breaches in a single year (HHS OCR, 2024), and one 2024 breach alone exposed 192M people.
-
02
A stolen medical identity cannot be canceled
Unlike a card, it corrupts the record itself, so a patient can be misdiagnosed from a chart that no longer describes them. For Quest, the same failure means exposure under the Health Insurance Portability and Accountability Act (HIPAA) and lost trust.
-
03
The security quiz failed both ways at once
Quest's earlier control was knowledge-based authentication: quiz questions pulled from public and credit records. A fraudster buys old addresses and loan amounts from a breach and answers every question, while the real patient cannot recall a mortgage from decades ago and loses access to their own results.
The National Institute of Standards and Technology (NIST) no longer recognizes knowledge-based questions as an acceptable authenticator, and a document-only replacement would only move the barrier: many patients have no ID or camera on hand when they need care.
Verify against data first, ask for more only when needed
Quest replaced static questions with a layered check inside MyQuest, leading with the lightest step and adding assurance only when the risk earns it.
A passive first check, no document needed
Non-Doc Verification (KYC)
The first layer confirms the patient against authoritative data in the background. Nothing to photograph, no selfie, no upload, so most patients clear it in under 2 seconds. The patients that knowledge-based questions shut out now get straight to their results.
More assurance, only when it is earned
Identity Verification
When a signal calls for a closer look, the check steps up to a document scan with a selfie and passive liveness. The friction meets the risky cases and stays out of the way of a routine result.
Verified at every request
Access is re-established each time results are opened, so one past check never becomes a standing key to a patient's record.
The security quiz, retired
The layered model replaced knowledge-based authentication across MyQuest, retiring a quiz that fraudsters could look up and honest patients could not pass.
The layered check runs live across the MyQuest account, from onboarding and lab-results access to account updates and appointment scheduling.
How it works
Built for healthcare-grade security
HIPAA-compliant
Built to handle protected health information, with a Business Associate Agreement in place.
A dedicated environment
The deployment is single-tenant, isolated from every other Incode customer.
U.S. data residency
Hosted in a U.S. region and shaped to Quest's own security review.
Privacy is the architecture
Incode made privacy a founding conviction long before regulation or the market asked for it. Its AI-first identity verification reduces fraud while remaining private and compliant.
Frequently asked questions
Questions specific to the Quest Diagnostics story
Still have questions? Talk to an expertHow does Quest Diagnostics verify patients in MyQuest?
Incode checks the patient against authoritative data behind the scenes, with nothing to photograph or upload. Only when a signal points to higher risk does the flow step up to a document scan with a selfie and passive liveness.
Why did Quest Diagnostics retire knowledge-based authentication?
The quiz failed in both directions: criminals who bought breached records could answer the questions, while genuine patients who forgot decades-old details were locked out of their own results. NIST also no longer accepts knowledge-based questions as an authenticator.
Can patients without an ID or camera get verified?
Yes. The first check needs no document, selfie, or upload, so patients with no ID to scan or camera on hand can still reach their results. A document is requested only when the risk calls for a closer look.
What results did Quest Diagnostics report with Incode?
Quest reports patient onboarding that is 5x faster, a completion rate of 98%, which is a 25% increase, and an average cost reduction of 50%.
How does the deployment meet healthcare security requirements?
It is HIPAA-compliant with a Business Associate Agreement in place, runs in a single-tenant environment separate from other Incode customers, and is hosted in a U.S. region shaped to Quest's own security review.
Does one verification give a patient standing access?
No. Verification is refreshed each time results are opened, and the layered check covers the whole MyQuest account, from onboarding and account updates to appointment scheduling.
What's next
See how Incode verifies identity in healthcare
Secure enough for health data, open enough for the patients who need it.