# Giga Romero v. Quest Diagnostics Incorporated - Filed Complaint and Accompanying Filings Canonical: https://hallattorneys.com/quest Source PDF: https://hallattorneys.com/dockets/quest-diagnostics/01-complaint.pdf Filed: October 23, 2026 Case number: 2:26-cv-13837 Court: U.S. District Court for the District of New Jersey The following is extracted text of the original 25-page filing packet, including the complaint, certification, civil cover sheet, and summons. Allegations are not findings. The PDF controls if extraction differs. Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 1 of 21 PageID: 1 UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY GIGA ROMERO, individually and on behalf of all Case No: 2:26-CV-13837 others similarly situated, CLASS ACTION COMPLAINT Plaintiff, JURY DEMAND REQUESTED v. QUEST DIAGNOSTICS INCORPORATED, Defendant. 1. Plaintiff Giga Romero ("Plaintiff") resides in Arapahoe County, Colorado. Her street address is omitted from this public pleading to protect her privacy and security in an action concerning confidential medical information and will be provided to the Court if required. Defendant Quest Diagnostics Incorporated ("Quest") maintains its principal place of business at 500 Plaza Drive, Secaucus, New Jersey 07094. Plaintiff brings this action individually and on behalf of all others similarly situated, through undersigned counsel, against Quest and its present, former, or future direct and indirect parent companies, subsidiaries, affiliates, agents, and/or other related entities. Plaintiff alleges the following on information and belief based on and the investigation of counsel, except as to those allegations that specifically pertain to Plaintiff, which are alleged upon personal knowledge. I. NATURE OF THE ACTION 2. This class action arises from unauthorized access to patient records in Quest’s Quanum Lab Services Manager ("Quanum LSM"), disclosed on October 22, 2026 (the "Data Breach"). Quest received and maintained confidential information in providing laboratory services Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 2 of 21 PageID: 2 to Plaintiff and other patients. Plaintiff alleges that Quest failed to use reasonable safeguards to protect that information and breached its undertaking to preserve its confidentiality. 3. Quest reported that it learned of unauthorized access to Quanum LSM on October 21, 2026. In its October 22, 2026 Form 8-K, Quest stated that an unauthorized party was believed to have accessed certain patient records. Quest also reported engaging outside cybersecurity experts and notifying federal law enforcement. 1 4. In its October 22 public incident notice, Quest acknowledged that protected health information or personally identifiable information was involved. It stated that it was determining the affected information and individuals and would provide legally required notices. Quest suspended access to Quanum LSM while investigating. The number of affected patients and the full set of affected data fields had not been publicly identified in that notice. 2 5. Plaintiff received laboratory testing from Quest repeatedly, including four identified testing dates in April and May 2026, and used MyQuest to access her medical records. On information and belief, her records were among those accessed in the Data Breach. Her testing history, portal experience, and resulting injuries are set out below. 6. "Private Information" means the personally identifiable information and protected health information contained in the patient records accessed in the Data Breach, including identifying information associated with laboratory orders and test results. The information involved for each patient will be established through the affected records and Quest’s investigation. 1 Quest Diagnostics Inc., Current Report (Form 8-K), cover page & Item 8.01 (Oct. 22, 2026), https://www.sec.gov/Archives/edgar/data/1022079/000094787126000941/ss6979200_8k.htm. 2 Quest Diagnostics, Quanum (Oct. 22, 2026, 12:00 p.m. ET), https://www.questdiagnostics.com/links/quanum-notice. 2 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 3 of 21 PageID: 3 7. Plaintiff alleges her own conduct and experiences on personal knowledge. Allegations concerning Quest’s operations and the Data Breach are based on the public disclosures identified below, counsel’s investigation, and information and belief where the relevant facts are principally within Quest’s possession. II. PARTIES 8. Plaintiff is an adult domiciled in and a citizen of Colorado. 9. Quest is a Delaware corporation with its principal place of business in Secaucus, New Jersey. Quest is therefore a citizen of Delaware and New Jersey for diversity purposes. 28 U.S.C. § 1332(c)(1). 3 10. Quest provides laboratory testing and related services. Its own public disclosure identifies Quanum LSM as a system used by certain Quest clients to submit laboratory orders and to obtain and search test results. Quest’s alleged liability here arises from its operation and control of that system and the information entrusted to it. III. JURISDICTION AND VENUE 11. This Court has subject-matter jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d)(2), (5)(B), and (6). Plaintiff is a Colorado citizen, Quest is a citizen of Delaware and New Jersey, and the proposed action satisfies minimal diversity. 12. On information and belief, the Nationwide Class includes at least 100 persons, and the aggregate amount in controversy exceeds $5,000,000, exclusive of interest and costs. This allegation is based on Quest’s nationwide laboratory services, Quanum LSM’s clinical ordering and results-access functions, Quest’s disclosure that unauthorized access involved patient information, and the aggregate compensatory and otherwise recoverable relief sought for affected 3 Quest Diagnostics Inc., Current Report (Form 8-K), cover page (Oct. 22, 2026). 3 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 4 of 21 PageID: 4 persons. The affected-person count and records necessary to quantify their claims are principally within Quest’s possession. 13. Quest maintains the affected-system, patient-identification, and investigation records necessary to determine the precise class size and scope. Jurisdiction rests on the Class Action Fairness Act, not a private federal cause of action under HIPAA. 14. This Court has personal jurisdiction over Quest because Quest maintains its principal place of business in New Jersey and is at home in this State. Venue is proper under 28 U.S.C. § 1391(b)(1) and (c)(2) because Quest resides in this District for venue purposes. 15. New Jersey choice-of-law rules govern the selection of substantive law. Plaintiff asserts Colorado law for her individual claims and the Colorado Subclass. To the extent that the applicable choice-of-law analysis selects New Jersey law for a common-law claim, Plaintiff pleads that theory in the alternative under Federal Rule of Civil Procedure 8(d). 16. Plaintiff seeks certification of the Nationwide Class for claims or common issues susceptible to common treatment under the governing law. Alternatively, she seeks certification of the Colorado Subclass and appropriate issue classes. IV. FACTUAL ALLEGATIONS A. Quest’s collection and use of confidential patient information 17. Quest’s laboratory services require it to receive and generate information associated with identifiable patients. That information is collected for clinical testing, communication of results, and related authorized purposes. The sensitivity of medical information makes access by an unauthorized person a foreseeable source of injury. 18. Quest describes Quanum LSM as a professional platform through which healthcare personnel can order laboratory tests, review results, monitor order status, and consult historical 4 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 5 of 21 PageID: 5 results. The platform’s clinical functions place patient information within an electronic environment that Quest operates for its healthcare clients. 4 19. Patients do not administer Quanum LSM’s access controls, security monitoring, or response procedures. Quest and those acting under its authority control those safeguards. Patients cannot independently inspect the system’s security or prevent an unauthorized person from exploiting deficiencies within it. 20. Quest’s Notice of Privacy Practices identifies laboratory orders, results, and invoices as examples of documents containing protected health information. The notice describes Quest’s responsibility to protect that information, limit its use and disclosure as required by law, and notify affected individuals of breaches involving unsecured protected health information. 5 21. Quest also represents that it maintains enterprise privacy and cybersecurity programs encompassing access controls, vulnerability management, risk assessments, incident response, and administrative, technical, and physical safeguards. These representations concern operational security measures designed to protect information entrusted to Quest. 6 22. The nature and volume of the confidential information within the system, Quest’s ability to control access, and the foreseeable consequences of unauthorized access required reasonable safeguards proportionate to the risks. Plaintiff alleges a duty to exercise reasonable care in performing the data-handling functions Quest undertook. 4 Quest Diagnostics, Quanum Lab Services Manager, https://www.questdiagnostics.com/healthcare- professionals/lab-tools-it-systems/quanum-lab-services-manager (last visited Oct. 22, 2026). 5 Quest Diagnostics, Notice of Privacy Practices, “Our Responsibilities” (effective Feb. 16, 2026), https://www.questdiagnostics.com/our-company/privacy/notice-of-privacy-practices. 6 Quest Diagnostics, Cybersecurity & Privacy, https://www.questdiagnostics.com/our- company/corporate-responsibility/cybersecurity---privacy (last visited Oct. 22, 2026). 5 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 6 of 21 PageID: 6 B. The October 2026 unauthorized access 23. Quest’s October 22 Form 8-K states that the company learned of unauthorized access to Quanum LSM on October 21. That date identifies Quest’s reported discovery of the incident; the public disclosure did not establish when the unauthorized access first began. 24. Quest reported its belief that patient records had been accessed and acknowledged that protected health information or personally identifiable information was involved. The precise population and affected data fields remained under investigation. 25. Quest itself suspended access to Quanum LSM after discovering the incident. Its October 22 notice stated: “Upon discovery of the incident, we paused access to the system.” Quest also temporarily suspended access to Essential Insights and LabHQ as a precaution, although it reported no data access in those systems. These suspensions were actions Quest took in responding to the incident. 7 26. The means and timing of entry, permissions used, records accessed, and operation of the relevant safeguards are principally within Quest’s knowledge. Its system logs, authentication and access records, risk assessments, and forensic investigation will identify the mechanism and scope of the intrusion. 27. On information and belief, Quest failed to implement and maintain reasonable technical safeguards restricting access to the affected patient records to authorized persons and authorized purposes. Those deficiencies permitted the unauthorized access Quest disclosed. This allegation rests on Quest’s control of the clinical platform and its access controls, its acknowledged unauthorized access, and the confidentiality undertaking and security requirements described below. 7 Quest Diagnostics, Quanum (Oct. 22, 2026, 12:00 p.m. ET), https://www.questdiagnostics.com/links/quanum-notice. 6 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 7 of 21 PageID: 7 28. Reasonable safeguards appropriate to the affected system would have prevented or materially limited the unauthorized access and resulting loss of confidentiality. The particular control failures and their operation will be established through Quest’s technical and investigative records. C. Foreseeability, security standards, and public cybersecurity warnings 29. Unauthorized access to clinical information was a risk known to Quest before October 2026. In December 2016, Quest disclosed an intrusion into the separate MyQuest by Care360 application involving protected health information of approximately 34,000 individuals, including laboratory results. That earlier event placed Quest on notice of the foreseeable consequences of unauthorized access to its patients’ medical information. 8 30. Before the Data Breach, federal agencies had identified vulnerability management as an established security practice. HHS’s voluntary healthcare cybersecurity goals identify mitigation of known vulnerabilities in Internet-accessible networks as an essential safeguard, supported by vulnerability scanning, procedures for responding to disclosed vulnerabilities, and prioritization of risk responses. The FTC likewise advises businesses to maintain a reasonable process for updating and patching third-party software and promptly addressing credible security warnings. 9 31. On October 21, 2026, the National Security Agency issued an advisory concerning two critical PHP vulnerabilities known as PHP2Shell. The advisory recommended identifying 8 Quest Diagnostics Inc., Quest Diagnostics Provides Notice of Data Security Incident (Dec. 12, 2016), https://ir.questdiagnostics.com/press-releases/press-release-details/2016/Quest-Diagnostics-Provides- Notice-of-Data-Security-Incident/default.aspx. 9 U.S. Dep’t of Health & Hum. Servs., Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals 2–5 (2024), https://hhscyber.hhs.gov/Documents/cybersecurity-performance-goals.pdf; Fed. Trade Comm’n, Start with Security: A Guide for Business 12 (June 2015), https://www.ftc.gov/system/files/documents/plain- language/pdf0205-startwithsecurity.pdf. 7 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 8 of 21 PageID: 8 affected systems, prioritizing applicable patches, enhancing logging, and taking affected systems offline if immediate updating was infeasible. PHP issued corrective releases that day. The advisory illustrates the importance of a process for identifying vulnerable components and promptly addressing risks to Internet-facing services. 10 32. Government bodies also used precautionary shutdowns to address the PHP vulnerabilities. The Netherlands’ National Cyber Security Centre reported on October 22, 2026, that it and other organizations, including government agencies, had temporarily taken websites offline. It recommended keeping still-vulnerable systems offline until updated. Those measures concerned systems affected by the PHP vulnerabilities. 11 33. Quest’s role as a healthcare provider handling electronic protected health information subjects the relevant activities to HIPAA’s Security Rule. The rule requires covered entities to protect the confidentiality, integrity, and availability of that information and guard against reasonably anticipated threats and impermissible uses or disclosures. 45 C.F.R. § 164.306(a) (2026). 34. The Security Rule requires an accurate and thorough risk analysis and measures sufficient to reduce identified risks and vulnerabilities to a reasonable and appropriate level. It also requires regular review of information-system activity and procedures to address security incidents. 45 C.F.R. § 164.308(a)(1)(ii)(A)–(B), (D), (a)(6) (2026). 10 Nat’l Sec. Agency, NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities (Oct. 21, 2026), https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory- critical-patches-recommended-for-php-vulnerabilities/; PHP, Security Advisory: Critical Remote Code Execution Vulnerabilities, Update Now, in News Archive—2026 (Oct. 21, 2026), https://www.php.net/archive/2026.php. 11 Nationaal Cyber Security Centrum, Update: PHP-kwetsbaarheden nog steeds reden om direct te patchen [Update: PHP Vulnerabilities Still Require Immediate Patching] (Oct. 21, 2026, updated Oct. 22, 2026), https://www.ncsc.nl/alerts/update-php-kwetsbaarheden-nog-steeds-reden-om-direct-te-patchen. 8 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 9 of 21 PageID: 9 35. Technical safeguards include access controls allowing access only to persons or software programs with access rights, mechanisms to record and examine system activity, and procedures to verify the identity of persons or entities seeking access. 45 C.F.R. § 164.312(a)(1), (b), (d) (2026). 36. These obligations address the very risk presented here: unauthorized access to identifiable patients’ electronic health information. Plaintiff invokes the standards as evidence of reasonable care and, for the Colorado negligence-per-se theory, as binding regulatory requirements. The claims do not seek a private federal remedy under HIPAA. 37. Reasonable protection requires implementation and maintenance of safeguards in practice. A security policy, vulnerability-management program, or incident-response plan must be carried out to protect the patient information entrusted to the system. Quest’s software inventory, patch records, access-control configuration, and investigation will establish which safeguards were applicable and how the intrusion occurred. D. Plaintiff’s Quest testing and MyQuest experience 38. Plaintiff received laboratory testing from Quest on April 23, April 29, April 30, and May 28, 2026, and on other occasions. To obtain those services, she furnished the identifying and health information Quest requested and authorized the ordered testing. Quest accepted that information, performed the testing, and maintained laboratory records associated with Plaintiff. 39. Plaintiff used MyQuest to access her Quest medical records. On October 22, 2026, she attempted to log in to retrieve her prior laboratory-testing dates, but Quest’s login system was unavailable. Quest’s page displayed "We’ll Be Right Back" and stated, "We are currently encountering technical difficulties with our login system." The page said Quest’s team was working to resolve the problem. Plaintiff captured the following screenshot: 9 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 10 of 21 PageID: 10 40. Quest directed users to a guest option for scheduling appointments during the interruption. The unavailability of Quest’s own login system prevented Plaintiff from retrieving her testing history through MyQuest on that attempt. Plaintiff reported that she would need to consult insurance-claim information to reconstruct the dates instead. 41. Through their course of dealing, Plaintiff requested and authorized Quest’s laboratory services and supplied the information necessary for those services. Quest accepted the information, provided the services, and retained the associated medical records. Their conduct manifested an undertaking to use reasonable safeguards to preserve the confidentiality of information entrusted for the testing and related authorized purposes. E. Plaintiff’s exposure and resulting injuries 42. Plaintiff learned of Quest’s October 22, 2026 disclosure of unauthorized access to patient records. On information and belief, the records accessed included Plaintiff’s identifying information and confidential laboratory information. That allegation is based on her recent and repeated Quest testing, Quest’s maintenance of her associated records, Quanum LSM’s function of providing access to patient orders and historical results, and Quest’s disclosure of its belief that certain patient records had been accessed. Quest’s affected record and investigative records will identify the particular records involved. 10 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 11 of 21 PageID: 11 43. The unauthorized access alleged above deprived Plaintiff of the confidentiality of medical information she entrusted to Quest for laboratory services. She did not authorize an outside intruder to obtain that information. The alleged access invaded her private medical affairs and concerns the kind of privacy injury traditionally protected against intrusion upon seclusion. 44. Plaintiff has spent more than three hours responding to the incident and investigating its effect on her information. Her response included attempting to retrieve her Quest testing history through MyQuest; the unavailable login system prevented that retrieval and required her to seek another source for the testing dates. 45. Plaintiff has experienced emotional distress concerning the loss of confidentiality alleged above and the prospect of an unauthorized person obtaining and using her private medical information. Her concern relates to the identifiable laboratory information she entrusted to Quest. 46. Plaintiff’s injuries include the loss of medical confidentiality alleged above, her actual response time, and emotional distress. She seeks recovery for the consequences of Quest’s conduct under the claims below, without duplicate recovery. 47. On information and belief, Quest’s deficient safeguards were a factual and proximate cause of the unauthorized access and resulting loss of confidentiality. The need for affected patients to investigate the disclosure and respond to its consequences was foreseeable when Quest undertook to maintain confidential patient records. V. CLASS ACTION ALLEGATIONS 48. Plaintiff brings this action under Federal Rule of Civil Procedure 23(a) and (b)(3) on behalf of the following proposed classes: 11 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 12 of 21 PageID: 12 49. Nationwide Class: All natural persons who resided in the United States when their personally identifiable information or protected health information was accessed by an unauthorized person in the Quanum LSM incident disclosed by Quest on October 22, 2026. 50. Colorado Subclass: All members of the Nationwide Class who were domiciled in Colorado when their information was affected by the Data Breach. 51. Excluded are Quest; its officers and directors; the judicial officers assigned to this action and their immediate families; and any person who timely and validly requests exclusion from a class certified under Rule 23(b)(3). 52. Class membership can be determined using objective evidence, including affected- record inventories, forensic and access records, and Quest’s notification records. The definitions turn on exposure in the identified incident and do not depend on a finding that Quest is liable to a particular person. 53. Numerosity. On information and belief, the Nationwide Class includes at least 100 individuals, and joinder is impracticable. Quest’s affected-record inventories, investigation, and notification records will identify class members and their geographic distribution. The nationwide scope and clinical functions of Quanum LSM support that inference; the precise affected-person count has not been publicly disclosed. Plaintiff will establish numerosity independently for the Colorado Subclass. 54. Commonality. The claims present common questions capable of common answers through evidence about the same incident and system, including the following: A. What patient information was accessible through the intrusion, and which records were actually accessed; 12 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 13 of 21 PageID: 13 B. What safeguards Quest maintained for Quanum LSM, whether those safeguards were reasonable, and which safeguards failed; C. Whether Quest performed the required risk analysis, access-control, audit, authentication, and security-management functions for the affected information; D. Whether the challenged safeguards and conduct caused the unauthorized access to the affected patient records; E. Whether materially uniform patient transactions and undertakings created an obligation to safeguard the entrusted information, and whether Quest breached that obligation; and F. What categories of injury and damages resulted from the challenged conduct and are recoverable under the governing law. 55. Typicality. Plaintiff’s claims arise from the same unauthorized access to the same clinical platform and the same alleged failures to protect patient information. Plaintiff’s exposure and resulting injuries arise from the course of conduct challenged on behalf of the classes. Differences in the amount of recoverable loss do not change the common alleged source of injury. 56. Adequacy. Plaintiff seeks to protect the same interests as the proposed class members and has no known conflict with them. She has retained counsel experienced in class litigation, including Hall Attorneys, P.C. and Federman & Sherwood. Plaintiff and her counsel will fairly and adequately protect the interests of the classes and seek appointment under Rule 23(g). 57. Predominance. Common evidence concerning the intrusion, the affected system, the security measures, and their causal relationship to unauthorized access will resolve central liability issues. For the implied-contract claim, Plaintiff seeks common treatment only for members whose 13 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 14 of 21 PageID: 14 materially similar transactions and undertakings can establish the alleged obligation through common proof. 58. Plaintiff will address actual differences in governing state law and demonstrate any proposed grouping of materially similar laws. Plaintiff seeks the Colorado Subclass as an alternative to nationwide certification and will propose only subclasses supported by an adequate representative and a workable trial plan. 59. Damages. Class members’ losses may be established through records and claims procedures consistent with the governing law. Plaintiff will present a damages methodology tied to the certified theory of liability and preserving each party’s right to contest causation and the amount of individual recovery. 60. Superiority. The cost of separate litigation over the same system and intrusion would discourage many individuals with relatively modest losses from pursuing relief. A class action can resolve shared issues efficiently, preserve consistent determinations, and provide notice and an opportunity to request exclusion where required. Concentrating the litigation here is appropriate because Quest maintains its principal place of business in this District. 61. Alternatively, Plaintiff seeks certification of appropriate common issues under Rule 23(c)(4), and subclasses under Rule 23(c)(5), to resolve shared liability questions while preserving any required individual determinations. VI. CLAIMS FOR RELIEF COUNT I — NEGLIGENCE (Plaintiff and the Nationwide Class; alternatively, the Colorado Subclass) 62. Plaintiff realleges paragraphs 1 through 61. This count is brought on behalf of Plaintiff and the Nationwide Class or, alternatively, the Colorado Subclass, under the governing common law identified above. 14 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 15 of 21 PageID: 15 63. Quest owed Plaintiff and class members a duty to exercise reasonable care in receiving, creating, retaining, securing, and controlling access to their confidential patient information. Quest undertook those functions in providing laboratory services and operating the affected clinical platform. 64. Quest controlled safeguards that patients could not administer or inspect. The sensitivity of identifiable medical information, the foreseeable harm from unauthorized access, and the relationship created by entrusting information for laboratory services support the duty to protect that information with reasonable care. 65. This duty arises from Quest’s undertaking and control of confidential patient information and the foreseeable consequences of negligent handling, independently of any particular contractual promise. 66. The HIPAA safeguards and recognized security practices described above further inform the standard of care. Reasonable care required effective restrictions on access to the affected information and safeguards suited to the system’s actual risks. 67. On information and belief, Quest breached its duty by failing to implement and maintain reasonable technical safeguards restricting access to the patient records within Quanum LSM to authorized persons and purposes. The alleged failures concern the affected system and information described above. 68. Those failures permitted the unauthorized patient-record access and resulting invasion of medical confidentiality alleged above. Reasonable safeguards would have prevented or materially limited that access and the resulting harm. 15 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 16 of 21 PageID: 16 69. Unauthorized intrusion was a foreseeable risk that made the safeguards necessary. A third party’s participation in the intrusion does not relieve Quest of responsibility for its own negligence in permitting foreseeable unauthorized access. 70. As a direct and proximate result, Plaintiff suffered the injuries described above, including loss of medical confidentiality, time spent responding to the incident, and emotional distress. Plaintiff and class members seek compensatory damages for injuries caused by Quest’s negligence and recoverable under the governing law, in an amount to be determined at trial. COUNT II — NEGLIGENCE PER SE (Colorado law; Plaintiff and the Colorado Subclass) 71. Plaintiff realleges paragraphs 1 through 61. This count is asserted on behalf of Plaintiff and the Colorado Subclass as an alternative basis for establishing negligence under Colorado law. 72. Colorado recognizes negligence per se when violation of an applicable safety enactment causes an injury of the kind the enactment was intended to prevent to a person within the protected class. Binding administrative regulations may supply the standard of conduct. 73. Quest’s handling of electronic protected health information in providing the laboratory services at issue is subject to HIPAA’s Security Rule. The rule requires safeguards protecting the confidentiality of that information and guarding against reasonably anticipated impermissible uses or disclosures. 45 C.F.R. § 164.306(a)(1), (3) (2026). 74. The technical access-control standard requires policies and procedures for systems maintaining electronic protected health information that allow access only to persons or software programs granted access rights. 45 C.F.R. § 164.312(a)(1) (2026). 75. Plaintiff and the Colorado Subclass are patients whose electronic protected health information Quest received, generated, or maintained. They are within the class the access-control 16 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 17 of 21 PageID: 17 standard protects. Unauthorized access to their identifiable medical information is the type of harm it is intended to prevent. 76. On information and belief, Quest violated 45 C.F.R. § 164.312(a)(1) by failing to implement and maintain technical access policies and procedures sufficient to restrict the affected patient records to persons and programs granted access rights. The allegation rests on Quest’s operation and control of Quanum LSM, the security undertaking described above, and its disclosure of unauthorized access to patient records. The deficient access safeguards permitted or materially contributed to the access alleged here; their specific operation is reflected in records maintained by Quest. 77. The violation was a factual and proximate cause of the unauthorized access, loss of medical confidentiality, and resulting injuries alleged above. Plaintiff and the Colorado Subclass seek compensatory damages recoverable under Colorado negligence law, without duplicate recovery under Count I. 78. This is a Colorado common-law claim invoking the identified regulatory standard, not a private federal enforcement action under HIPAA. If the Court determines that the standard does not establish negligence per se, Plaintiff alternatively invokes it as evidence of the standard of reasonable care under Count I. COUNT III — BREACH OF IMPLIED-IN-FACT CONTRACT (Plaintiff and the Nationwide Class; alternatively, the Colorado Subclass) 79. Plaintiff realleges paragraphs 1 through 61. This count is brought on behalf of Plaintiff and the Nationwide Class or, alternatively, the Colorado Subclass. It is pleaded in the alternative to any inconsistent tort theory under Rule 8(d). 17 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 18 of 21 PageID: 18 80. Plaintiff and Quest formed an implied-in-fact agreement through their laboratory- services transactions. Plaintiff requested and authorized testing, supplied the identifying and health information Quest requested for that purpose, and authorized its use for the testing and related services. Quest accepted that information, performed the testing, and maintained the associated patient records. 81. The parties’ conduct manifested an undertaking to provide the laboratory services and to use reasonable safeguards for the confidentiality of the information entrusted and generated in that exchange. Quest’s published descriptions of its patient-information practices, identified above, further support the character of that undertaking. 82. Plaintiff performed her obligations by providing the requested information and authorization and cooperating in the provision of the ordered laboratory services. 83. Materially similar patient transactions and undertakings established the same obligation for members of the proposed contract class. Quest’s standardized patient materials, service records, and practices will establish the common terms and the persons to whom they applied. 84. On information and belief, Quest breached its undertaking by failing to implement and maintain reasonable safeguards restricting unauthorized access to the entrusted information. That failure permitted the unauthorized access and resulting loss of confidentiality alleged above. 85. Loss of the confidentiality of the entrusted medical information and the need to respond to its unauthorized disclosure were foreseeable consequences of a failure to perform that undertaking. Plaintiff seeks the damages recoverable for the breach and the resulting consequences described above. 18 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 19 of 21 PageID: 19 86. Plaintiff seeks compensatory damages for losses proven to result from the breach and, if a breach is established without proof of compensatory damages, nominal damages. Any award will exclude duplicate recovery under the negligence counts. VII. REQUEST FOR RELIEF WHEREFORE, Plaintiff, individually and on behalf of the proposed classes, requests judgment against Quest and the following relief: A. Certification of the appropriate class or subclasses under Rule 23; appointment of Plaintiff as class representative; and appointment of Plaintiff’s counsel as class counsel under Rule 23(g); B. Compensatory damages in an amount to be determined at trial, and nominal damages for breach of contract where compensatory damages are not established; C. Prejudgment and postjudgment interest as allowed by law, taxable costs, and reasonable attorneys’ fees to the extent authorized by applicable law or a recognized equitable doctrine; and D. Such other relief as the Court deems just and proper, without duplicate recovery. VIII. DEMAND FOR JURY TRIAL Plaintiff demands a trial by jury on all issues so triable under Federal Rule of Civil Procedure 38. Dated: October 23, 2026, Respectfully submitted, By: /s/: Mark K. Svensson Mark K. Svensson (3802020221) MILBERG, PLLC 405 East 50th Street New York, New York 10022 Tel: (202) 975-0468 msvensson@milberg.com 19 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 20 of 21 PageID: 20 Nicholas Hall (Texas Bar No. 24069863) HALL ATTORNEYS, P.C. (Pro hac vice admission to be sought) P.O. Box 1370, Edna, Texas 77957 Telephone: (713) 428-8967 nhall@hallattorneys.com William B. Federman (Oklahoma Bar No. 2853) (Pro hac vice admission to be sought) Jessica A. Wilkes (Oklahoma Bar No. 34823) (Pro hac vice admission to be sought) FEDERMAN & SHERWOOD 10205 North Pennsylvania Avenue Oklahoma City, Oklahoma 73120 Telephone: (405) 235-1560 Facsimile: (405) 239-2112 wbf@federmanlaw.com jaw@federmanlaw.com Attorneys for Plaintiff and the Proposed Class 20 Case 2:26-cv-13837 Document 1 Filed 10/23/26 Page 21 of 21 PageID: 21 CERTIFICATION PURSUANT TO LOCAL CIVIL RULE 11.2 1. I, Mark Svensson of Milberg LLC, represent Plaintiff and make this certification pursuant to Local Civil Rule 11.2 following reasonable inquiry concerning other proceedings involving the matter in controversy. 2. The matter in controversy is the October 2026 unauthorized access to patient information in Quest’s Quanum Lab Services Manager identified in the accompanying complaint. 3. As of October 23, 2026: Two related case have been filed, Johnson, Mesmer, Schwarz v. Quest Diagnostics Incorporated, Case No. 2:26-cv-13795 (D. of NJ) (filed October 22, 2026); Vasey v. Quest Diagnostics Incorporated, Case No.: 2:26-cv-13820 (D. of NJ) (filed October 23, 2026). The matter in controversy is not subject of any pending arbitration or administrative proceeding. 4. I declare under penalty of perjury that the foregoing is true and correct. 28 U.S.C. § 1746. Dated: October 23, 2026, Respectfully submitted, /s/ Mark Svensson Mark Svensson CERTIFICATION PURUSANT TO L. CIV. R. 201.1 I certify that the damages recoverable in this Action exceed the sum of $150,000, exclusive of interest and costs and any claim for punitive damages, and that this Action is therefore not appropriate for compulsory arbitration. Dated: October 23, 2026, Respectfully submitted, /s/ Mark Svensson Mark Svensson 21 JS 44 (Rev. 04/21) Case 2:26-cv-13837 CIVIL COVER Document SHEET 1-1 Filed 10/23/26 Page 1 of 2 PageID: 22 The JS 44 civil cover sheet and the information contained herein neither replace nor supplement the filing and service of pleadings or other papers as required by law, except as provided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for the purpose of initiating the civil docket sheet. (SEE INSTRUCTIONS ON NEXT PAGE OF THIS FORM.) I. (a) PLAINTIFFS DEFENDANTS GIGA ROMERO, individually and on behalf of all QUEST DIAGNOSTICS INCORPORATED others similarly situated (b) County of Residence of First Listed Plaintiff County of Residence of First Listed Defendant Hudson County, NY (EXCEPT IN U.S. PLAINTIFF CASES) (IN U.S. PLAINTIFF CASES ONLY) NOTE: IN LAND CONDEMNATION CASES, USE THE LOCATION OF THE TRACT OF LAND INVOLVED. (c) Attorneys (Firm Name, Address, and Telephone Number) Attorneys (If Known) Mark K. Svensson, MILBERG PLLC; 405 East 50th Street, New York, New Unknown York, 10022; Tel: (202) 975-0468; msvennson@milberg.com II. BASIS OF JURISDICTION (Place an “X” in One Box Only) III. CITIZENSHIP OF PRINCIPAL PARTIES (Place an “X” in One Box for Plaintiff (For Diversity Cases Only) and One Box for Defendant) 1 U.S. Government 3 Federal Question PTF DEF PTF DEF Plaintiff (U.S. Government Not a Party) Citizen of This State 1 1 Incorporated or Principal Place 4 4 x of Business In This State 2 U.S. Government x 4 Diversity Citizen of Another State x2 2 Incorporated and Principal Place 5 5 Defendant (Indicate Citizenship of Parties in Item III) of Business In Another State Citizen or Subject of a 3 3 Foreign Nation 6 6 Foreign Country IV. NATURE OF SUIT (Place an “X” in One Box Only) Click here for: Nature of Suit Code Descriptions. CONTRACT TORTS FORFEITURE/PENALTY BANKRUPTCY OTHER STATUTES 110 Insurance PERSONAL INJURY PERSONAL INJURY 625 Drug Related Seizure 422 Appeal 28 USC 158 375 False Claims Act 120 Marine 310 Airplane 365 Personal Injury - of Property 21 USC 881 423 Withdrawal 376 Qui Tam (31 USC 130 Miller Act 315 Airplane Product Product Liability 690 Other 28 USC 157 3729(a)) 140 Negotiable Instrument Liability 367 Health Care/ INTELLECTUAL 400 State Reapportionment 150 Recovery of Overpayment 320 Assault, Libel & Pharmaceutical PROPERTY RIGHTS 410 Antitrust & Enforcement of Judgment Slander Personal Injury 820 Copyrights 430 Banks and Banking 151 Medicare Act 330 Federal Employers’ Product Liability 830 Patent 450 Commerce 152 Recovery of Defaulted Liability 368 Asbestos Personal 835 Patent - Abbreviated 460 Deportation Student Loans 340 Marine Injury Product New Drug Application 470 Racketeer Influenced and (Excludes Veterans) 345 Marine Product Liability 840 Trademark Corrupt Organizations 153 Recovery of Overpayment Liability PERSONAL PROPERTY LABOR 880 Defend Trade Secrets 480 Consumer Credit of Veteran’s Benefits 350 Motor Vehicle 370 Other Fraud 710 Fair Labor Standards Act of 2016 (15 USC 1681 or 1692) 160 Stockholders’ Suits 355 Motor Vehicle 371 Truth in Lending Act 485 Telephone Consumer 190 Other Contract Product Liability 380 Other Personal 720 Labor/Management SOCIAL SECURITY Protection Act 195 Contract Product Liability x 360 Other Personal Property Damage Relations 861 HIA (1395ff) 490 Cable/Sat TV 196 Franchise Injury 385 Property Damage 740 Railway Labor Act 862 Black Lung (923) 850 Securities/Commodities/ 362 Personal Injury - Product Liability 751 Family and Medical 863 DIWC/DIWW (405(g)) Exchange Medical Malpractice Leave Act 864 SSID Title XVI 890 Other Statutory Actions REAL PROPERTY CIVIL RIGHTS PRISONER PETITIONS 790 Other Labor Litigation 865 RSI (405(g)) 891 Agricultural Acts 210 Land Condemnation 440 Other Civil Rights Habeas Corpus: 791 Employee Retirement 893 Environmental Matters 220 Foreclosure 441 Voting 463 Alien Detainee Income Security Act FEDERAL TAX SUITS 895 Freedom of Information 230 Rent Lease & Ejectment 442 Employment 510 Motions to Vacate 870 Taxes (U.S. Plaintiff Act 240 Torts to Land 443 Housing/ Sentence or Defendant) 896 Arbitration 245 Tort Product Liability Accommodations 530 General 871 IRS—Third Party 899 Administrative Procedure 290 All Other Real Property 445 Amer. w/Disabilities - 535 Death Penalty IMMIGRATION 26 USC 7609 Act/Review or Appeal of Employment Other: 462 Naturalization Application Agency Decision 446 Amer. w/Disabilities - 540 Mandamus & Other 465 Other Immigration 950 Constitutionality of Other 550 Civil Rights Actions State Statutes 448 Education 555 Prison Condition 560 Civil Detainee - Conditions of Confinement V. ORIGIN (Place an “X” in One Box Only) x 1 Original Proceeding 2 Removed from State Court 3 Remanded from Appellate Court 4 Reinstated or 2:26-cv- Reopened 5 Transferred from Another District 6 Multidistrict Litigation - 8 Multidistrict Litigation - (specify) Transfer Direct File Cite the U.S. Civil Statute under which you are filing (Do not cite jurisdictional statutes unless diversity): 28 U.S.C 1332 (d) VI. CAUSE OF ACTION Brief description of cause: Data Breach VII. REQUESTED IN x CHECK IF THIS IS A CLASS ACTION DEMAND $ CHECK YES only if demanded in complaint: COMPLAINT: UNDER RULE 23, F.R.Cv.P. $5,000,000.00 JURY DEMAND: x Yes No VIII. RELATED CASE(S) (See instructions): IF ANY JUDGE not yet assigned DOCKET NUMBER 2:26-cv-13820 ;2:26-cv-13795 DATE SIGNATURE OF ATTORNEY OF RECORD October 23, 2026 /s/ Mark. K. Svensson FOR OFFICE USE ONLY RECEIPT # AMOUNT APPLYING IFP JUDGE MAG. JUDGE Case 2:26-cv-13837 JS 44 Reverse (Rev. 04/21) Document 1-1 Filed 10/23/26 Page 2 of 2 PageID: 23 INSTRUCTIONS FOR ATTORNEYS COMPLETING CIVIL COVER SHEET FORM JS 44 Authority For Civil Cover Sheet The JS 44 civil cover sheet and the information contained herein neither replaces nor supplements the filings and service of pleading or other papers as required by law, except as provided by local rules of court. This form, approved by the Judicial Conference of the United States in September 1974, is required for the use of the Clerk of Court for the purpose of initiating the civil docket sheet. Consequently, a civil cover sheet is submitted to the Clerk of Court for each civil complaint filed. The attorney filing a case should complete the form as follows: I.(a) Plaintiffs-Defendants. Enter names (last, first, middle initial) of plaintiff and defendant. If the plaintiff or defendant is a government agency, use only the full name or standard abbreviations. If the plaintiff or defendant is an official within a government agency, identify first the agency and then the official, giving both name and title. (b) County of Residence. For each civil case filed, except U.S. plaintiff cases, enter the name of the county where the first listed plaintiff resides at the time of filing. In U.S. plaintiff cases, enter the name of the county in which the first listed defendant resides at the time of filing. (NOTE: In land condemnation cases, the county of residence of the "defendant" is the location of the tract of land involved.) (c) Attorneys. Enter the firm name, address, telephone number, and attorney of record. If there are several attorneys, list them on an attachment, noting in this section "(see attachment)". II. Jurisdiction. The basis of jurisdiction is set forth under Rule 8(a), F.R.Cv.P., which requires that jurisdictions be shown in pleadings. Place an "X" in one of the boxes. If there is more than one basis of jurisdiction, precedence is given in the order shown below. United States plaintiff. (1) Jurisdiction based on 28 U.S.C. 1345 and 1348. Suits by agencies and officers of the United States are included here. United States defendant. (2) When the plaintiff is suing the United States, its officers or agencies, place an "X" in this box. Federal question. (3) This refers to suits under 28 U.S.C. 1331, where jurisdiction arises under the Constitution of the United States, an amendment to the Constitution, an act of Congress or a treaty of the United States. In cases where the U.S. is a party, the U.S. plaintiff or defendant code takes precedence, and box 1 or 2 should be marked. Diversity of citizenship. (4) This refers to suits under 28 U.S.C. 1332, where parties are citizens of different states. When Box 4 is checked, the citizenship of the different parties must be checked. (See Section III below; NOTE: federal question actions take precedence over diversity cases.) III. Residence (citizenship) of Principal Parties. This section of the JS 44 is to be completed if diversity of citizenship was indicated above. Mark this section for each principal party. IV. Nature of Suit. Place an "X" in the appropriate box. If there are multiple nature of suit codes associated with the case, pick the nature of suit code that is most applicable. Click here for: Nature of Suit Code Descriptions. V. Origin. Place an "X" in one of the seven boxes. Original Proceedings. (1) Cases which originate in the United States district courts. Removed from State Court. (2) Proceedings initiated in state courts may be removed to the district courts under Title 28 U.S.C., Section 1441. Remanded from Appellate Court. (3) Check this box for cases remanded to the district court for further action. Use the date of remand as the filing date. Reinstated or Reopened. (4) Check this box for cases reinstated or reopened in the district court. Use the reopening date as the filing date. Transferred from Another District. (5) For cases transferred under Title 28 U.S.C. Section 1404(a). Do not use this for within district transfers or multidistrict litigation transfers. Multidistrict Litigation – Transfer. (6) Check this box when a multidistrict case is transferred into the district under authority of Title 28 U.S.C. Section 1407. Multidistrict Litigation – Direct File. (8) Check this box when a multidistrict case is filed in the same district as the Master MDL docket. PLEASE NOTE THAT THERE IS NOT AN ORIGIN CODE 7. Origin Code 7 was used for historical records and is no longer relevant due to changes in statute. VI. Cause of Action. Report the civil statute directly related to the cause of action and give a brief description of the cause. Do not cite jurisdictional statutes unless diversity. Example: U.S. Civil Statute: 47 USC 553 Brief Description: Unauthorized reception of cable service. VII. Requested in Complaint. Class Action. Place an "X" in this box if you are filing a class action under Rule 23, F.R.Cv.P. Demand. In this space enter the actual dollar amount being demanded or indicate other demand, such as a preliminary injunction. Jury Demand. Check the appropriate box to indicate whether or not a jury is being demanded. VIII. Related Cases. This section of the JS 44 is used to reference related cases, if any. If there are related cases, insert the docket numbers and the corresponding judge names for such cases. Date and Attorney Signature. Date and sign the civil cover sheet. Case 2:26-cv-13837 Document 1-2 Filed 10/23/26 Page 1 of 2 PageID: 24 AO 440 (Rev. 12/09) Summons in a Civil Action UNITED STATES DISTRICT COURT for the District __________ of New District of Jersey __________ ) ) Plaintiff ) v. ) Civil Action No. ) ) Defendant ) SUMMONS IN A CIVIL ACTION To: (Defendant’s name and address) A lawsuit has been filed against you. Within 21 days after service of this summons on you (not counting the day you received it) — or 60 days if you are the United States or a United States agency, or an officer or employee of the United States described in Fed. R. Civ. P. 12 (a)(2) or (3) — you must serve on the plaintiff an answer to the attached complaint or a motion under Rule 12 of the Federal Rules of Civil Procedure. The answer or motion must be served on the plaintiff or plaintiff’s attorney, whose name and address are: If you fail to respond, judgment by default will be entered against you for the relief demanded in the complaint. You also must file your answer or motion with the court. CLERK OF COURT Date: Signature of Clerk or Deputy Clerk Case 2:26-cv-13837 Document 1-2 Filed 10/23/26 Page 2 of 2 PageID: 25 AO 440 (Rev. 12/09) Summons in a Civil Action (Page 2) Civil Action No. PROOF OF SERVICE (This section should not be filed with the court unless required by Fed. R. Civ. P. 4 (l)) This summons for (name of individual and title, if any) was received by me on (date) . I personally served the summons on the individual at (place) on (date) ; or I left the summons at the individual’s residence or usual place of abode with (name) , a person of suitable age and discretion who resides there, on (date) , and mailed a copy to the individual’s last known address; or I served the summons on (name of individual) , who is designated by law to accept service of process on behalf of (name of organization) on (date) ; or I returned the summons unexecuted because ; or Other (specify): . My fees are $ for travel and $ for services, for a total of $ . I declare under penalty of perjury that this information is true. Date: Server’s signature Printed name and title Server’s address Additional information regarding attempted service, etc: