Quantum computing pressure is colliding with healthcare’s aging encryption
Healthcare systems are entering a race they have not yet fully acknowledged. Practical quantum computers could one day break the encryption that protects patient records, imaging files, laboratory data and connected devices, and a new assessment suggests the sector is still behind on preparation.
The concern is not a science-fiction attack wave arriving overnight. The nearer danger is quieter and already underway: encrypted data can be stolen now, then stored until quantum-capable systems can unlock it later. In healthcare, where records can remain clinically and financially sensitive for decades, that timeline creates a long tail of risk. A stolen chart today may still matter years from now if it contains diagnoses, medication histories, procedures or genetic information.
Researchers reviewed more than 2.5 million devices across more than 50 healthcare organizations and found a stark split between ordinary IT systems and medical technology. Only 6% of medical devices had security strong enough to withstand future quantum attacks, compared with 50% of IT systems. The gap matters because bedside equipment is not a side network accessory; infusion pumps, patient monitors and other connected devices sit directly inside the care environment, where patching is slow and operational downtime is hard to tolerate.
Medical devices are lagging behind the rest of the network
The numbers point to a practical problem that hospital leaders know well. Medical devices are notoriously difficult to update, often because vendors control software changes, hardware lifecycles are long, and clinical teams cannot casually pull devices offline without affecting care. Traditional IT assets may be refreshed on a shorter cycle and can move more quickly toward post-quantum cryptography. Devices tied to patient monitoring or drug delivery do not enjoy that flexibility.
Researchers also looked at more than 5,500 internet-facing healthcare systems, including patient portals and application programming interfaces. Only 31% supported an encryption protocol capable of supporting post-quantum cryptography. In plain terms, a large portion of externally exposed systems still lack a path to the next generation of protection, even before a practical quantum computer exists.
The risk profile is especially concerning because healthcare does not store a single kind of data. Electronic medical records, medical imaging and lab results carry different clinical and legal implications, yet all of them depend on confidentiality. Once those data leave the network, they can be copied without notice and retained indefinitely. The value of that archive rises if an attacker can later decrypt it at scale.
Harvest now, decrypt later is the clearest threat model
Daniel Trivellato, vice president of operational technology, healthcare and cyber risk solutions at Forescout, framed the issue around “harvest now, decrypt later.” The strategy is straightforward: attackers collect encrypted healthcare data today and wait for quantum capabilities to mature. The target is not only identity theft or financial fraud. A decrypted medical file could reveal diagnoses, prescriptions, imaging findings, reproductive history or other intimate details that patients reasonably expect to remain private for life.
Current cyber pressure already shows why this matters. Forescout tracked 461 public ransomware claims against healthcare providers globally from January through August of this year, a 47% increase from the same period last year. More than 60% targeted U.S. organizations. Quantum risk sits on top of that existing burden, not in place of it.
For hospitals and health systems, the economics are unforgiving. IBM estimates healthcare data breaches cost about $6.64 million on average. Quantum readiness therefore cannot be treated as a separate theoretical project reserved for an uncertain future. It has to be folded into the same modernization decisions that already govern infrastructure refreshes, procurement cycles and vendor contracts.
One sentence captures the operational reality: insecure data left in place today may remain readable for years if the cryptography underneath it is not upgraded.
Post-quantum migration will test governance, not just technology
The move toward post-quantum cryptography is already taking shape. Established standards from the National Institute of Standards and Technology provide a technical foundation, and the agency released its first set of post-quantum cryptography standards in 2024. Even so, technical standards alone will not move a health system. Asset inventories, vendor coordination, device replacement planning and governance across security, clinical engineering and compliance teams will determine whether migration happens in time.
The challenge is complicated by the mix of systems inside a typical healthcare environment. IT still accounts for 66% of connected devices, but the smaller share represented by medical equipment can carry outsized risk because these devices are embedded in care delivery. A single vulnerable pump, monitor or imaging platform can create exposure if it remains tied to older cryptographic methods. External systems such as patient portals and APIs widen the attack surface further, especially when they connect patients, clinicians and partner organizations across multiple access points.
Trivellato advised healthcare leaders to start by taking stock of assets and high-risk systems. That sequence is essential because organizations cannot protect what they have not mapped. Leaders also face a procurement problem: a device purchased today may remain in service long after current encryption standards have aged out, so quantum readiness needs to be part of purchasing language now rather than a retrofit years later.
Regulation may arrive slowly, but exposure already exists
On the regulatory front, the path remains unsettled. Trivellato said it is still an open question whether healthcare will eventually face specific post-quantum cryptography requirements or whether the standards will be folded into broader cybersecurity obligations. Either route would place pressure on providers, but waiting for a formal mandate would be a costly strategy. Healthcare data does not stop being sensitive while policy catches up.
That uncertainty leaves hospitals with a narrower, more immediate task: identify the systems most likely to retain long-lived sensitive data, evaluate which devices cannot be updated easily, and treat encryption migration as part of routine technology renewal. The organizations that move first will have more time to test compatibility, train staff and negotiate with vendors. The ones that wait will face a compressed and more disruptive conversion when pressure finally arrives.
For now, the report’s central message is blunt. Healthcare is not ready for quantum computing threats, and the sector’s oldest devices and most exposed systems are already trailing the standards that will eventually be required to keep patient data private.