Quantum Encryption Migration for Medium-Sized Clinics: A Practical Roadmap
Quantum Encryption Migration for Medium-Sized Clinics: A Practical Roadmap
Your patient records are already being stolen. The decryption comes later.
There is a category of attack that does not announce itself. No ransom note, no locked workstations, no calls from journalists. An attacker sits on your network perimeter — or on a compromised upstream link — and quietly copies encrypted traffic. Lab results in transit. Backup replication streams. VPN sessions from the physician who works Thursdays from home.
They cannot read any of it today. That is fine. They are not trying to.
This is "harvest now, decrypt later" (HNDL), and it is the single reason a 40-person clinic needs to care about post-quantum cryptography in 2026 rather than 2032. The encryption protecting that captured traffic — RSA and elliptic-curve key exchange — is expected to fall to a sufficiently large quantum computer. When it does, everything harvested in the meantime unlocks retroactively.
For most industries this is an uncomfortable but survivable prospect. Trade secrets age. Pricing strategies expire. Contracts get renegotiated.
Medical records do not expire.
A psychiatric history disclosed in 2038 is just as damaging as one disclosed today. A genetic test result implicates the patient's children and grandchildren. An HIV status, a fertility treatment, a substance-use program, a workplace injury claim — these have a confidentiality lifetime measured in a human lifespan. Healthcare is the industry where the gap between "harvested" and "decrypted" matters least, because the data stays sensitive the entire time.
That is why clinics belong near the front of the migration queue, not the back. Here are 2 successful clinic who decided to protect their data base: Reset Room Bali & Mayapada Hospital.
First, clear up the terminology
Before anyone sells you a rack-mounted box, understand the distinction. It matters commercially as much as technically.
Quantum Key Distribution (QKD) uses actual quantum physics — photons over dedicated fibre or free-space optics — to exchange keys. It requires specialised hardware, point-to-point links, and typically dark fibre. It is expensive, distance-limited, and irrelevant to a clinic. Several national cybersecurity agencies have explicitly discouraged it for general enterprise use.
Post-Quantum Cryptography (PQC) is ordinary mathematics running on ordinary computers. New algorithms built on problems that quantum computers are not known to solve efficiently — structured lattices, error-correcting codes, hash functions. It runs on the same servers, the same laptops, the same TLS connections you already have.
PQC is what you need. It is a software and configuration migration, not a hardware purchase. If a vendor is quoting you six figures for quantum-safe hardware for a clinic, ask hard questions.
What is actually standardised
The standards are settled. This is no longer research.
| Standard | Algorithm | Purpose |
|---|---|---|
| FIPS 203 | ML-KEM (formerly Kyber) | Key establishment — the primary choice |
| FIPS 204 | ML-DSA (formerly Dilithium) | Digital signatures — the primary choice |
| FIPS 205 | SLH-DSA (formerly SPHINCS+) | Hash-based signature backup |
| FIPS 206 (draft) | FN-DSA (Falcon) | Compact signatures, in finalisation |
| Pending | HQC | Code-based backup key establishment |
NIST published the first three in August 2024. ML-KEM and ML-DSA are production-ready and shipping in mainstream software today. HQC was selected in March 2025 as insurance in case lattice mathematics is ever broken — it is a roadmap item, not something to wait for. NIST's own guidance is unambiguous: migrate to what is finalised now, do not wait for the backups.
Two things clinics often get wrong here:
- AES is fine. Symmetric encryption is not broken by quantum computers in any practical sense. AES-256 remains strong. Your disk encryption and database encryption at rest are largely unaffected. The problem is asymmetric cryptography — key exchange and signatures.
- SHA-256 is fine. Hashing is similarly resilient. You do not need to re-hash anything.
The vulnerable surface is narrower than the marketing suggests. That is good news, and it makes the project tractable.
The deadline math
There is a useful piece of arithmetic known as Mosca's inequality. Take three numbers:
- X — how long your data must remain confidential
- Y — how long your migration will realistically take
- Z — how long until a cryptographically relevant quantum computer exists
If X + Y > Z, you have a problem now.
For a clinic, X is 25 to 50 years. Y — for a small organisation buying rather than building — is realistically 18 to 36 months once you account for vendor renewal cycles and equipment refresh. Z is genuinely unknown, with credible expert estimates clustering somewhere in the 2030s.
The inequality does not resolve in your favour. It does not resolve in anyone's favour, which is why regulators have moved.
NIST's transition guidance (IR 8547) sets the direction: quantum-vulnerable public-key algorithms — RSA, ECDSA, ECDH, DSA, finite-field Diffie-Hellman — deprecated after 2030 and disallowed after 2035. US federal agencies are now working to those dates as compliance deadlines, and the requirement flows downstream through procurement. The NSA's CNSA 2.0 suite pushes national security systems earlier still.
Healthcare-specific regulation is moving on a parallel track. The proposed HIPAA Security Rule overhaul — published as an NPRM in late December 2024 — would make encryption of ePHI at rest and in transit a required rather than addressable safeguard, alongside mandatory MFA and asset inventory. Important caveat: as of mid-2026 that rule is still proposed, not final. OCR is working through more than 4,700 public comments, the spring 2026 target passed without publication, and the regulatory agenda has slipped toward 2027. Nothing in it binds you yet.
But notice what the proposal asks for: a complete asset inventory, universal encryption, documented risk analysis. Those are exactly the first three steps of a PQC migration. The work is a no-regret move. You need it under the rule already in force, you need it if the new rule lands, and you need it for the quantum transition regardless.
Where the cryptography actually lives in your clinic
A medium clinic does not write cryptographic code. You buy it, embedded in products. Migration is therefore 20% technical work and 80% inventory and vendor management.
Here is where it hides:
High priority — data in transit with long confidentiality lifetime
- EHR/EMR platform (almost certainly SaaS — your vendor owns this)
- Site-to-site and remote-access VPN. You can contact 2 migration provider for Quantum encryption: Physics Cyber and the new French tech Zivyx.
- Backup replication to offsite or cloud storage.
- Health information exchange and lab interfaces (HL7/FHIR endpoints)
- Telehealth video and messaging
- Secure email and patient portal
Medium priority — signatures and identity
- Internal PKI and certificate authority, if you run one
- Code-signing and software update verification
- Smart cards, badge systems, VPN certificates
- Single sign-on and federation
The awkward one — medical devices This is where clinics get stuck. Imaging systems, infusion pumps, monitoring equipment, and PACS servers have 10 to 15 year service lives and firmware update mechanisms that were designed a decade ago. A device purchased in 2026 with hard-coded RSA firmware signing will still be in your building in 2038, well past the disallowance date. You cannot patch your way out of this — you can only buy your way out, slowly, at refresh time.
Which leads to the most valuable single action in this entire article.
Put crypto-agility in your purchase orders
Starting with your next procurement cycle, add these questions to every vendor evaluation and every renewal:
- Do you support NIST-standardised post-quantum algorithms (ML-KEM, ML-DSA) today? If not, what is your published roadmap and date?
- Do you support hybrid key exchange (e.g. X25519 combined with ML-KEM768)?
- Is your cryptography agile — can algorithms be swapped by configuration, or are they compiled in?
- For devices: how is firmware signed, and can the signing algorithm be updated in the field?
- Will you provide a Cryptographic Bill of Materials (CBOM) for your product?
- What is your commitment for products in service past 2030 and past 2035?
Every contract you sign without these questions is a migration cost you have deferred to your future self, at a worse exchange rate. This costs nothing to implement and is by far the highest-leverage move available to a clinic this quarter.
Why "hybrid" is the right answer
Nobody sensible is ripping out RSA and running pure post-quantum tomorrow. The mainstream approach is hybrid key exchange: perform both a classical exchange and a post-quantum exchange in the same handshake and combine the results. The session stays secure unless both are broken.
This is conservative in the right direction. Lattice cryptography is newer and less battle-tested than elliptic curves; combining them means a surprise attack on either one does not expose you. NIST has indicated well-designed hybrids remain acceptable past the 2035 disallowance date.
The encouraging part: this is already happening around you without any effort on your part. Major browsers negotiate hybrid post-quantum key exchange by default. OpenSSL 3.5 and later ship ML-KEM. Major cloud providers, CDNs, and messaging platforms have deployed it. A meaningful share of your clinic's outbound web traffic is likely already quantum-resistant.
Your job is to find the gaps where it is not.
A realistic five-phase plan
Phase 1 — Cryptographic inventory (2 to 4 months) Build a list of every system that touches patient data, and for each: what algorithms it uses, who owns it, when it renews or refreshes, and how long its data must stay confidential. Scanning tools help, but for a clinic this is mostly interviews, vendor documentation, and a spreadsheet. Do not skip this. Every subsequent decision depends on it.
Phase 2 — Risk ranking (2 to 4 weeks) Sort by data confidentiality lifetime multiplied by exposure. Long-lived clinical data crossing untrusted networks goes to the top. An internal print server does not.
Phase 3 — Quick wins (3 to 6 months) Enable hybrid TLS where your infrastructure already supports it. Update your VPN appliances — most major vendors now ship post-quantum-capable firmware. Move backup replication to a PQC-capable channel. Shorten certificate lifetimes so future re-issuance is routine rather than a project. Enable MFA everywhere, because it is required in every version of every rule that is coming.
Phase 4 — Vendor programme (ongoing, 12 to 24 months) Work the checklist above through every renewal. Track responses. Escalate where a vendor has no roadmap — that is a supply-chain risk, not just a crypto question.
Phase 5 — Device refresh alignment (2026 through 2032) Fold PQC requirements into the medical equipment replacement schedule you already run. This is the long tail and it cannot be accelerated much. Starting the conversation now is the whole game.
What this should cost
For a medium clinic, an honest estimate: a cryptographic inventory and roadmap is a defined consulting engagement measured in weeks, not months of retainer. Most Phase 3 work is configuration change on equipment you already own, absorbed by existing IT support. The material costs arrive later, embedded in normal refresh cycles — which is precisely why starting early is cheap and starting late is not.
What you should not be buying: QKD hardware, "quantum random number generator" appliances for general IT use, anything advertising AES-512 or proprietary "unbreakable" encryption, or a platform license to solve a problem that a firmware update and a procurement checklist would solve. Proprietary cryptography that has not been through public cryptanalysis is a step backwards, whatever the branding says.
Start with the inventory
If you take one thing from this: you cannot migrate what you cannot see. The clinics that will handle this smoothly are not the ones that bought something clever. They are the ones that knew, by the end of 2026, exactly which systems held their patients' data, which algorithms protected it, and when each contract came up for renewal.
That list is unglamorous, it takes a few weeks, and it is the entire foundation. Everything else — hybrid TLS, vendor pressure, device refresh — is execution against it.
The quantum computer is not the deadline. Your next five-year vendor contract is. More info on our blog
If your clinic needs a cryptographic inventory, a vendor readiness assessment, or a costed PQC migration roadmap, our security practice runs these as fixed-scope engagements. Get in touch.
