Quest Diagnostics
Health Care
44
out of 100. Number 266 of 512, counting from the worst.
Where Quest Diagnostics does well
- Arbitration 0 of 20. Nothing found.
- Renewals 0 of 20. Nothing found.
- Quest's public-facing Terms & Conditions contain no forced-arbitration or class-action waiver — disputes go to New Jersey state/federal courts, which is better than many peers.
- The Privacy Notice explicitly states 'We do not sell Personal Information,' and SMS opt-in/consent data is explicitly never shared or sold to third parties for their own marketing.
- The HIPAA Notice requires written authorization before using PHI for marketing or selling it (with limited exceptions), and Quest is certified under the EU-US Data Privacy Framework.
- The Privacy Notice also states children's data collected by mistake will be deleted, and it publishes a real phone line ((833) 341-0196) plus a 45-day response commitment for privacy-rights requests.
Quest strips identifying details from your lab results and then treats the stripped data as completely free of privacy restrictions — it can be used for any purpose, including its Health Trends research business, with no further patient consent.
The fine print
7 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Quest strips identifying details from your lab results and then treats the stripped data as completely free of privacy restrictions — it can be used for any purpose, including its Health Trends research business, with no further patient consent.
Once information has been de-identified as required by law, it is no longer PHI and we may use it for any lawful purpose.
-
Despite claiming not to sell personal information, Quest shares your name, contact details, browsing/search history, location, and psychological profiles built from your data with ad companies and social networks for targeted advertising (which California law explicitly defines as 'sharing').
When you visit our websites, we may share information about your use of our website with our advertising and analytics partners... Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name... Internet or other electronic network activity information, including, but not limited to, browsing history, search history... Geolocation data... Inferences drawn from any personal information collected to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes — Disclosed for Targeted Advertising? Yes — Marketing and promotional third parties such as advertising and social networks.
-
Quest's own chart admits it hands sensitive data — including your health information and genetic information — to analytics and marketing partners. For a lab that handles STD, genetic, and drug-testing results, this is far more permissive than patients would expect.
Sensitive personal information, including driver's license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sex life, precise or specific geolocation, information concerning your health, and genetic information... Disclosed for a Business Purpose? Yes — Service providers, analytics, marketing, and promotional partners, and third parties for operational purposes.
-
Quest can rewrite its terms whenever it wants with no direct notice to you; the new terms take effect the moment they're posted, and merely continuing to use the site counts as your agreement to them.
Quest Diagnostics may, at any time and from time to time, change these terms and conditions. Any changes to these terms and conditions will be effective immediately upon posting of the changed terms and conditions on the Site. You agree to review these terms and conditions periodically, and use of the Site following any such change constitutes your agreement to follow and be bound by the terms and conditions as changed.
Terms & Conditions (Section 4, Right to Change Terms and Conditions)
-
When Quest changes its HIPAA privacy practices, the new rules apply retroactively — including to health data it already collected from you before the change.
We reserve the right to amend the terms of this Notice to reflect changes in our privacy practices, and to make the new terms and practices applicable to all PHI that we maintain about you, including PHI created or received prior to the effective date of the Notice revision.
-
Retention is defined only by Quest's own vague business needs — no fixed time limit — and even when they stop 'retaining' your data, copies in backups can live on indefinitely.
Quest Diagnostics retains your Personal Information only for as long as is necessary for our legitimate business purposes... Additionally, we may continue to store your Personal Information contained in our standard back-ups.
-
Quest put Meta's tracking pixel on its site, which sent Facebook users' real identities paired with the URLs of the pages they visited — including test-results pages. A proposed class action alleged this exposed patient data without consent; the case was ultimately dismissed in Nov 2025 (Third Circuit, nonprecedential) on technical 'eavesdropping' grounds, but the pixel deployment itself was real.
Quest Diagnostics' Facebook tracking pixel 'disclosed medical information because it transmitted a patient's Facebook ID and other Facebook identifiers... alongside event data that disclosed the URL of the webpage a patient accessed to review test results.'
Class complaint in Cole v. Quest Diagnostics (reported by Law Street Media and Bloomberg Law)
How these were found
Read directly from questdiagnostics.com on Oct 1, 2026: Terms & Conditions (no revision date shown on page), Privacy Notice 'Last Updated: December 31, 2025', HIPAA Notice of Privacy Practices 'Effective: February 16, 2026'. MyQuest portal and QuestDirect checkout terms sit behind login/purchase flows and were not reviewed; any forced-arbitration language there is out of scope. The Meta tracking-pixel incident is drawn from external reporting (Bloomberg Law, Law Street Media, Eric Goldman blog) rather than a Quest document; Quest won dismissal of that case (Third Circuit, Nov 2025, nonprecedential opinion), so the finding reflects the documented pixel deployment, not a legal finding of wrongdoing. No mirrors were needed; the official site loaded directly.
These notes come from the original draft and are not independent verification.