You've detected unauthorized access to a system containing Protected Health Information (PHI). Your team is assembled, and federal law enforcement has been contacted. Now you face a decision that will shape your organization's breach response, regulatory exposure, and operational continuity: Do you immediately suspend the affected system, or do you maintain operations while you investigate?
This isn't a theoretical exercise. Quest Diagnostics identified unauthorized access to its Quantum Lab Services Manager system on October 21, 2026, and chose to temporarily pause access while investigating. The company serves around one-third of adult Americans and half of U.S. physicians and hospitals, yet it determined that operational disruption was the safer path. Your calculus may differ.
The Decision You're Facing
When you confirm unauthorized access to a system that processes, stores, or transmits PHI, you must decide whether to:
Path A: Suspend system access immediately while you investigate scope and impact
Path B: Maintain operations with enhanced monitoring while conducting a parallel investigation
Path C: Implement a hybrid approach with restricted functionality
Each path carries distinct compliance implications under the HIPAA Security Rule's incident response requirements (§164.308(a)(6)) and affects your Breach Notification Rule timeline.
Key Factors That Affect Your Choice
System criticality to patient care operations
If the compromised system directly supports diagnostic services, treatment decisions, or emergency care, suspension creates immediate clinical risk. Quest's LSM system handles test orders and results, but the company maintained service continuity through fax, paper, and direct electronic medical record interfaces.
Evidence preservation requirements
Continuing to operate a compromised system can overwrite logs, destroy forensic artifacts, and complicate your investigation. If you suspect ongoing exfiltration, every minute of continued access expands the breach scope.
Containment confidence level
Can you isolate the threat vector without full suspension? If your incident response protocol identified the entry point and you've implemented remedial measures to prevent further unauthorized access, you may not need complete shutdown.
Regulatory notification clock
The Breach Notification Rule requires notification to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Your investigation timeline starts when you know (or should have known) that a breach occurred. System suspension doesn't stop this clock, but it may provide clearer evidence for your risk assessment.
Business Associate dependencies
If the compromised system serves external clients or Business Associates, your decision affects their operations and their own HIPAA obligations. Quest's LSM system served "certain clients" rather than its entire customer base, which narrowed the operational impact.
Path A: Immediate System Suspension
Choose this path when:
- You cannot confirm containment of the unauthorized access
- The system handles high-risk data (substance abuse treatment records, HIV status, genetic information)
- Forensic evidence suggests active, ongoing exfiltration
- You have documented alternative workflows that maintain care continuity
- The affected population is identifiable and limited
Implementation steps:
- Document the suspension decision and business justification in your incident response log
- Activate your documented contingency plan (HIPAA Security Rule §164.308(a)(7))
- Communicate alternative access methods to affected users within the first hour
- Preserve system state for forensic analysis before implementing remediation
- Establish a daily review cadence to determine when restoration is safe
Regulatory considerations:
The Office for Civil Rights (OCR) will review whether your suspension decision was reasonable given what you knew at the time. If you maintain operations and the breach expands, you'll need to explain why continued access was justified. If you suspend and later determine no breach occurred, document your risk-based reasoning.
Path B: Maintained Operations with Enhanced Monitoring
Choose this path when:
- You've identified and closed the specific vulnerability or access vector
- The system is essential to patient safety with no viable alternatives
- Your investigation suggests a time-limited intrusion rather than persistent access
- You can implement real-time monitoring that would detect resumed unauthorized activity
- Suspension would create greater risk than continued monitored operation
Implementation steps:
- Deploy enhanced logging on all system access, focusing on the previously compromised functions
- Implement temporary access restrictions (reduce user privileges, require multi-factor authentication, limit remote access)
- Assign dedicated security personnel to monitor alerts during the investigation window
- Establish clear tripwires that would trigger immediate suspension
- Document your monitoring approach and decision criteria in your incident response file
Regulatory considerations:
If you choose this path, your Security Rule risk analysis must support the decision. OCR expects you to weigh the probability and criticality of potential impacts. You'll need documentation showing that maintained operations with enhanced controls presented lower overall risk than suspension.
Path C: Restricted Functionality Hybrid
Choose this path when:
- Core functions can operate safely while high-risk features are disabled
- You can segment users into trusted and potentially compromised groups
- The system supports modular access controls
- Investigation timeline is measured in days, not hours
Implementation steps:
- Disable remote access, API connections, or third-party integrations while maintaining internal clinical functions
- Restrict access to users with documented business need and verified credentials
- Implement manual approval for any data exports or bulk queries
- Maintain full operations for read-only access while suspending write functions that could obscure evidence
Quest Diagnostics appears to have used elements of this approach, pausing LSM access while maintaining service through alternative channels.
Summary Matrix
| Factor | Suspend (Path A) | Monitor (Path B) | Restrict (Path C) |
|---|---|---|---|
| Containment confidence | Low or uncertain | High, vector identified | Moderate, partial isolation possible |
| Alternative workflows | Documented and tested | None available | Partial alternatives exist |
| Data sensitivity | High-risk categories present | Standard PHI only | Mixed sensitivity levels |
| Investigation timeline | 1-3 days expected | 24-48 hours expected | 3-7 days expected |
| Operational impact | Acceptable with workarounds | Unacceptable to patient care | Manageable with restrictions |
| Forensic requirements | Preservation critical | Real-time monitoring sufficient | Selective preservation needed |
The Decision You Document Matters More Than the Decision You Make
OCR doesn't expect perfect foresight. The agency expects documented, risk-based decision-making that reflects your organization's specific circumstances. Whether you choose suspension, monitoring, or restriction, your incident response documentation must show:
- What you knew at the time of the decision
- What risk factors you weighed
- What alternatives you considered
- What safeguards you implemented
- When and why you would change course
Quest Diagnostics engaged third-party cybersecurity experts and notified federal law enforcement, demonstrating that it followed its incident response protocol. Your protocol should define decision criteria in advance, so you're not creating policy in the middle of a crisis.
The right path depends on your risk tolerance, your operational constraints, and your ability to execute each option competently. Choose the path you can defend with documentation, not the path that feels safest in the moment.
