Post-quantum encryption is now a hospital records problem

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Crayonic's blog post: Long-lived hospital records face a store-now, decrypt-later risk because current public-key cryptography may not protect medical data for its full retention period.

Why it matters: IAM, PKI and security teams in healthcare need to treat cryptographic agility as a governance issue, not a future migration, because record retention spans outlast today's encryption assumptions.

By the numbers:

• England's NHS Records Management Code sets a minimum of 25 years for maternity records and 30 years from diagnosis for cancer records.
• Google's Craig Gidney estimated in May 2025 that RSA-2048 could be factored in less than a week with fewer than a million noisy qubits.
• The Global Risk Institute survey rates a cryptographically relevant quantum computer as quite possible, 28 to 49%, within ten years.
• Forescout found that only 31% of more than 5,500 internet-exposed healthcare systems supported TLS 1.3.

Context

Post-quantum cryptography matters in healthcare because the confidentiality window for clinical records is measured in decades, not years. When retention rules require patient data to remain secret long after systems are replaced, the risk is not just future decryption but the durability of today’s encryption choices.

Post-quantum readiness for identity and PKI becomes relevant because hospital PKI, signed records and device trust chains all sit inside the same migration problem. Hospitals that wait for quantum capability to become concrete will discover that inventory, procurement and certificate lifecycle work should already have started.

Key questions

Q: How should hospitals prioritise post-quantum migration for patient records?

A: Hospitals should prioritise patient records that must remain confidential for ten years or more, then move outward to systems that store or transmit those records. The first targets are data at rest, backups, archives, and network links that rely on public-key cryptography, because those are the places where harvested ciphertext can be stored now and decrypted later. Inventorying cryptographic dependencies and setting migration windows by data lifespan gives the clearest order.

Q: Why does long-lived medical data create quantum risk before quantum computers exist?

A: Long-lived medical data creates quantum risk because an attacker can capture encrypted records now and keep them until future quantum computers can break the public-key cryptography protecting them. This matters for patient histories, imaging, genetics, and insurance records that retain value for many years. The exposure is often called harvest now, decrypt later, and it affects any system that relies on RSA, ECC, or similar key exchange and encryption.

Q: Why do hybrid certificates matter during post-quantum migration?

A: They let classical and quantum-safe trust coexist while applications, devices, and partners move at different speeds. That reduces compatibility risk during migration, but only if the PKI can issue and manage them consistently. Hybrid support is a transition control, not proof that the estate is already ready.

Q: What should teams do first when legacy devices cannot support post-quantum crypto?

A: Teams should first replace unsupported cryptography at the highest-risk boundary, usually by terminating traffic on a modern gateway or proxy that can run post-quantum or hybrid key exchange on behalf of the legacy device. If that is not possible, isolate the device, limit the data it handles, and wrap it with compensating controls such as segmentation and short-lived tunnels while planning replacement. The first step is to stop unsupported public-key use from persisting on exposed links.

Technical breakdown

Store-now, decrypt-later changes the threat model for encrypted health data

Classical public-key cryptography protects confidentiality only while the underlying math remains hard. The quantum threat changes the timeline, not the mechanism: adversaries can capture encrypted traffic or backups now and decrypt them later when capable machines exist. That makes long-retention data a present-day target even before any quantum computer is operational. In healthcare, the issue is amplified by records that must remain private for many years, which extends the useful life of stolen ciphertext far beyond the system that produced it. See the Crypto-Agility Guide.

Practical implication: Prioritise any encryption boundary that protects long-lived clinical data, archives or backups for early PQC transition planning.

TLS, PKI and signed records do not migrate on the same schedule

Healthcare environments mix short-lived transport security with long-lived trust artifacts. TLS protects data in motion, but PKI roots, firmware signing keys and digitally signed records may need to remain verifiable for decades. That creates different migration pressures across the same environment. Hybrid deployments are therefore the realistic transition pattern: classical and post-quantum algorithms co-exist while certificate hierarchies, device trust and archival verification are rebuilt around new primitives. See the Machine Identity, PKI and Certificate Lifecycle Guide.

Practical implication: Separate transport, identity and archival trust dependencies so PKI migration does not stall critical clinical workflows.

PQC key sizes create operational pressure on constrained devices

The new NIST standards increase signature and key sizes, which affects smart cards, embedded devices and low-bandwidth clinical systems. That is not a cryptographic flaw, but an engineering constraint: larger artifacts consume memory, bandwidth and processing headroom. The practical challenge is making these systems work with dual-stack credentials and new certificate formats without breaking login, signing or device attestation flows. Healthcare infrastructure with older hardware will feel this first.

Practical implication: Test post-quantum certificate and signature handling on constrained endpoints before procurement commitments lock in obsolete hardware.

NHI Mgmt Group analysis

Hospitals are dealing with a governance gap, not a distant science-fiction risk. The real failure mode is assuming confidentiality horizons match technology refresh cycles. In healthcare, retention rules routinely outlast cryptographic assumptions, so encryption strategy has to be judged against the life of the record, not the life of the server. That makes cryptographic inventory and migration planning an identity and access governance issue as much as a cryptography issue.

Store-now, decrypt-later is a data protection problem with NHI consequences. PKI, certificates, signing keys and device trust chains are non-human identities in practice, and their lifecycles will decide whether clinical systems can survive the transition. Where hospitals cannot map those trust dependencies, they cannot plan revocation, replacement or hybrid operation responsibly. The control gap is not just weak algorithms, but lack of lifecycle visibility across machine trust.

Crypto-agility is the named capability that separates prepared organisations from exposed ones. The article points to the need for configurable algorithm replacement, inventory discipline and procurement language that does not freeze old primitives into long-lived systems. In practical terms, a hospital that cannot swap cryptographic components without rebuilding its entire environment has already created migration debt. The practitioner conclusion is to measure agility before the quantum deadline measures it for you.

Clinical environments will fail first where legacy hardware meets long-lived trust. Smart cards, firmware signing and devices with limited memory will expose the most friction because post-quantum formats are larger and operationally heavier. That means the transition plan has to include constrained endpoints, not just servers and browsers. Organisations should expect hybrid credentials and staged replacement rather than a clean cutover.

The industry signal is that PQC planning is becoming a procurement and architecture decision, not a cryptography lab exercise. Once long-lived records and constrained devices are both in scope, the work touches vendor selection, certificate policy and archive assurance. Security leaders should treat that as a board-level timing issue, because the cost of delay is measured in irrecoverable exposure windows.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Crypto-Agility Guide

What this signals

Crypto-agility debt: the hidden risk is not only old cryptography, but environments that cannot change algorithms without breaking trust flows. Health organisations should assume the hardest work is in certificate hierarchies, device dependencies and procurement language, not in the abstract choice of algorithm.

Hospitals should treat PQC as a lifecycle issue across identity, PKI and archival assurance, because the assets most likely to outlive current cryptography are the same ones least tolerant of disruption. The programme implication is clear: if cryptographic inventory is missing, migration planning is already behind.

Retention periods, not release cycles, should drive prioritisation. When confidential data must remain private for 25 or 30 years, the migration clock starts well before a quantum system becomes practical, so roadmap alignment should move into security architecture reviews now.

For practitioners

• Build a cryptographic inventory Map every place public-key cryptography is used, including TLS endpoints, VPNs, PKI, backups, archives, smart cards and device signing.
• Rank systems by data lifetime Prioritise any control that protects information needing confidentiality for ten years or more, because those assets face the most acute store-now, decrypt-later exposure.
• Add PQC requirements to procurement Require suppliers to state post-quantum roadmap dates, crypto-agility support and migration dependencies before new equipment is approved.
• Plan PKI migration early Review certificate hierarchies, root trust, card lifecycles and signed-document validity now, because those dependencies take the longest to replace.
• Use hybrid algorithms during transition Keep classical and post-quantum algorithms in parallel where feasible so clinical services can move without breaking authentication or archival verification.

Key takeaways

• Hospital records create a quantum-era confidentiality problem because their retention periods are far longer than the life of current cryptographic assumptions.
• The most exposed areas are long-lived archives, backups, PKI roots, signing keys and constrained devices that cannot absorb larger post-quantum artifacts easily.
• Security teams should build a cryptographic inventory, rank assets by data lifetime and plan hybrid migration before procurement decisions freeze legacy trust chains.

Related NHI Mgmt Group resources: Post-Quantum Readiness for Identity and PKI · Crypto-Agility Guide · Machine Identity, PKI and Certificate Lifecycle Guide · Cryptography Basics Guide

Key terms

• Post-Quantum Cryptography: Cryptographic algorithms designed to remain secure against attacks from sufficiently powerful quantum computers. In practice, PQC is a migration problem as much as an algorithm problem because organisations must replace trust anchors, certificates, and secrets without breaking identity-dependent systems.
• Store now, decrypt later: An attacker captures encrypted data today with the expectation that future cryptographic advances will make it readable later. This is especially relevant where identity traffic, secrets, or certificates protect information that must remain confidential for years.
• Crypto-Agility: Crypto-agility is the ability to change cryptographic algorithms, certificates, and trust dependencies without redesigning production systems. It matters because cryptographic standards evolve, and organisations need accurate inventories and automated lifecycle controls before they can migrate safely.
• Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security and IAM practitioners connect identity lifecycle controls to the broader trust dependencies their programmes depend on.