Healthcare organizations should start preparing for post-quantum cryptography (PQC), but not because quantum computers are known to be attacking hospitals today. The practical concern is that sufficiently capable quantum computers could threaten some public-key cryptography, while encrypted health information collected now may remain sensitive long enough to be targeted for decryption later. Preparation starts with finding where cryptography is used, then prioritizing systems and planning upgrades with vendors—not buying one product and declaring the organization quantum-ready.
What “quantum-ready” means for a healthcare organization
Being quantum-ready is an organizational capability, not a product label. A healthcare organization should know where cryptography protects its systems and data, identify algorithms and dependencies that may need to change, understand which systems are most important to protect, and have a workable migration plan with its technology suppliers.
As an Amazon Associate I earn from qualifying purchases.
That work is relevant to clinical and administrative environments, but it does not mean every system is equally exposed or that every encryption method is threatened in the same way. NIST says sufficiently capable quantum computers could threaten current public-key cryptography, including RSA and elliptic-curve cryptography. PQC refers to cryptographic methods designed to resist attacks from both classical and quantum computers. NIST’s PQC overview explains the current standards effort.
Recommended Free Tools
Why healthcare data merits early planning
Some health information must remain confidential for many years. The “harvest now, decrypt later” concern is that an adversary could collect encrypted information today and attempt to decrypt it in the future if a sufficiently capable quantum computer becomes available. That possibility makes the required secrecy lifetime of data a useful planning factor; it does not establish that such decryption is happening now.
#1 Best Overall
Healthcare also relies on connected systems and services. A cryptographic change in one product can depend on certificates, protocols, libraries, network connections, identity services, or other suppliers. Migration therefore involves discovering dependencies and testing interoperability as well as choosing cryptographic standards. The 2023 joint CISA, NSA, and NIST quantum-readiness fact sheet recommends early planning, risk assessment, inventories, roadmaps, and vendor engagement.
For context, HHS reported that large-breach reports increased 102% from 2018 to 2023, individuals affected by large breaches increased 1002% over that period, and more than 167 million individuals were affected by large breaches in 2023. HHS attributes the broader breach trend primarily to hacking and ransomware; these figures are not quantum incidents and do not show that quantum attacks have affected healthcare. HHS’s HIPAA Security Rule NPRM page provides that breach context.
Where can you start your migration to PQC?
NIST’s answer begins with visibility: an organization cannot prioritize or migrate cryptography it has not identified. NIST’s PQC migration FAQ describes an inventory that can include algorithms, keys, certificates, protocols, libraries, hardware security modules, and other cryptographic components. Treat the inventory as a map of dependencies, not merely a list of encryption products.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
1. Map the systems and services to investigate
Start with the organization’s technology estate and its suppliers. Depending on the environment, areas to investigate may include clinical and administrative applications, cloud services, networks, endpoints, medical devices, backups, identity systems, and vendor-managed services. This is a discovery prompt, not a claim that every item in the list uses vulnerable cryptography.
2. Record cryptographic assets and dependencies
For each relevant system or service, record known algorithms, keys, certificates, protocols, libraries, cryptographic hardware, and external cryptographic services. Where information is available, add the system owner, supplier, data protected, business or clinical criticality, dependencies, and upgrade constraints. Mark unknowns explicitly so teams can follow up rather than treating missing information as proof of safety.
3. Prioritize by risk, not by a universal ranking
There is no single healthcare-wide priority order established by the cited guidance. Use these factors together to identify what needs attention first:
- Data sensitivity and secrecy lifetime: how harmful disclosure would be and how long the information must remain confidential.
- Cryptographic exposure: whether and where the system relies on public-key cryptography that may be vulnerable to a sufficiently capable quantum computer.
- Operational and clinical impact: what could happen if a system, connection, or cryptographic change fails.
- Dependencies and visibility: whether the organization understands how the system connects to other products and services.
- Supplier readiness and upgradeability: whether the vendor can support a transition and whether the product can be updated.
- Lifecycle and timing: planned replacements, procurement cycles, validation needs, and available change windows.
For example, long-lived sensitive data may justify early planning, while a tightly coupled clinical system may require more interoperability testing before any change. Those are prompts for risk assessment, not a prescribed score or a claim that one category of healthcare system always outranks another.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute4. Ask vendors for specific migration information
Vendor coordination matters because organizations depend on interconnected clinical and administrative products. In procurement and technical reviews, ask suppliers:
- Which finalized PQC standards do you support, and what is your transition plan?
- How will updates be delivered, and what customer action or downtime may be required?
- What interoperability testing has been completed for relevant protocols, certificates, and connected products?
- Which legacy products cannot be updated, and what are the support or replacement options?
- What information can you provide to help us identify cryptographic components and dependencies in your product?
These are practical questions derived from the need for inventories, vendor engagement, and interoperability planning; they are not a quoted official checklist.
Rank #4
5. Sequence changes and test before broad deployment
Build a roadmap with accountable owners, procurement and validation steps, planned change windows, and documented risk decisions. Test compatibility and performance in the relevant environment before broad deployment. Track products that require replacement, supplier action, or interim risk controls, and make dependencies visible so a change in one system does not cause an avoidable failure elsewhere.
6. Keep the inventory and plan current
Cryptographic components, suppliers, standards, and system lifecycles change. Revisit the inventory and priorities as those changes occur, and include cryptographic visibility and transition requirements in technology governance and procurement where appropriate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What NIST’s finalized standards change—and what they do not
NIST reports that three PQC standards have been finalized and are available for implementation, and urges organizations to begin transition planning. Its migration work addresses cryptographic visibility and risk management as well as interoperability and benchmarking. NIST’s explanation of post-quantum cryptography quotes project lead Dustin Moody encouraging organizations to begin transitioning to help keep data secure in the quantum era.
Finalized standards give organizations and suppliers a basis for implementation; they do not make every healthcare product compatible or mean every system can be migrated at once. Organizations still need to identify where cryptography is deployed, confirm vendor support, test dependencies, and schedule changes in a way that protects clinical and administrative operations.
How this relates to HIPAA
HHS says the HIPAA Security Rule currently in effect requires appropriate administrative, physical, and technical safeguards to protect electronic protected health information. HHS’s Security Rule overview is available at hhs.gov/hipaa/for-professionals/security.
HHS issued a Security Rule Notice of Proposed Rulemaking on December 27, 2024. The NPRM page says the current Security Rule remains in effect while rulemaking proceeds. Any encryption, inventory, or other requirement discussed in that NPRM is a proposal, not an effective requirement merely because it appeared in the proposed rule. The cited healthcare-sector guidance and NCVHS recommendations support planning and risk analysis; they are not a separate binding PQC mandate. See HHS’s quantum cryptography guidance for the health sector and the NCVHS recommendation letter.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
