Quantum computing is coming, and healthcare isn't ready

Overview

The healthcare industry faces a critical security challenge on the horizon: quantum computing's ability to break current encryption standards that protect patient data. While large-scale quantum computers capable of cracking today's cryptographic systems may still be years away, the threat is immediate—adversaries are already harvesting encrypted healthcare data today to decrypt later once quantum capabilities mature. This "harvest now, decrypt later" strategy puts protected health information at risk for decades to come, yet most healthcare organizations lack quantum-readiness plans or even awareness of the threat timeline.

Key Developments

The quantum computing timeline creates unique vulnerabilities for healthcare organizations that store long-term patient records. Unlike other industries where data loses value quickly, medical records retain sensitivity for patients' entire lifetimes. Current encryption standards like RSA-2048, which underpins most healthcare data transmission and storage, will become obsolete when sufficiently powerful quantum computers emerge. The National Institute of Standards and Technology (NIST) has already published post-quantum cryptography standards, but healthcare adoption remains minimal. Meanwhile, nation-state actors and sophisticated cybercriminal groups are intercepting and archiving encrypted healthcare data traffic, creating massive repositories of information that will become readable once quantum decryption becomes feasible.

Industry Impact

The quantum threat amplifies existing healthcare cybersecurity challenges rather than creating entirely new ones. Healthcare organizations already struggling with basic security hygiene—outdated systems, weak access controls, insufficient encryption implementation—face exponentially greater risk as the quantum timeline compresses. The shift to quantum-resistant cryptography requires not just new algorithms but comprehensive infrastructure upgrades, vendor coordination for medical device security, and workforce training on post-quantum protocols. For independent practices, the complexity appears overwhelming, yet inaction compounds risk. Every year of delay means more patient data potentially harvested and archived by adversaries.

What This Means for Your Practice

Independent practices must begin quantum-readiness planning now, even if full quantum computers remain distant. Start by inventorying what encryption protocols your systems currently use—your EHR, patient portal, email, cloud storage, and vendor connections. Determine which vendors have post-quantum cryptography roadmaps and timelines. Prioritize implementing crypto-agility—the ability to swap cryptographic algorithms without overhauling entire systems. Strengthen current encryption standards as a bridge measure: ensure all systems use TLS 1.3 or higher, implement AES-256 encryption for data at rest, and audit vendor Business Associate Agreements for encryption requirements. Most critically, minimize data retention—quantum threats make the "keep everything forever" approach to medical records increasingly dangerous.