Post-Quantum Cryptography in Healthcare

Post-Quantum Cryptography in Healthcare

Researchers at Forescout Vedere Labs assessed the healthcare sector's readiness to migrate to post-quantum cryptography (PQC). Their analysis of more than 2.5 million devices across over 50 healthcare organizations revealed a significant readiness gap between traditional IT systems and specialized medical devices, many of which are difficult to upgrade due to their long operational lifecycles.

Medical devices lag significantly behind in PQC readiness. Across the networks analyzed, 50% of IT devices, such as workstations and servers, run OpenSSH versions that support PQC. That figure drops to 16% for operational technology (OT) devices, such as building automation systems and backup generators, and just 6% for connected medical devices (IoMT). However, running a compatible software version does not necessarily mean PQC is already in use.

Long device lifecycles make migration more challenging. Patient monitors, infusion pumps, diagnostic systems, and other specialized medical devices often remain in service for many years. Updating their cryptographic capabilities can depend on vendor release cycles, firmware updates, recertification, or even replacing the equipment entirely. As a result, migrating these systems to PQC is likely to take considerably longer than upgrading traditional IT infrastructure.

Internet-exposed healthcare systems face similar challenges. Researchers identified more than 5,500 instances of internet-exposed medical information systems, including electronic medical record (EMR) platforms (46%) and picture archiving and communication systems (PACS) (40%). On average, only 31% of these systems support TLS 1.3, the only TLS version that can accommodate standardized PQC mechanisms. Meanwhile, 15% still support the deprecated TLS 1.0 and TLS 1.1 protocols.

Healthcare data is particularly vulnerable to harvest-now, decrypt-later (HNDL) attacks. Attackers can intercept and store encrypted traffic with the intention of decrypting it once sufficiently powerful quantum computers become available. Unlike passwords or payment data, medical histories, genetic information, laboratory results, and diagnostic images cannot simply be reset or replaced after a breach. Their sensitivity persists throughout a patient's lifetime.

Migration priorities depend on data sensitivity, not just device type. Forescout identifies five categories of healthcare data most at risk from future quantum attacks: electronic health records, medical imaging, laboratory results, medication and prescription data, and financial/payment information. Particular attention should be given to data transmitted over external networks, especially through patient portals, cloud applications, and information exchanges between healthcare organizations. _ PQC migration in healthcare faces a fundamental challenge: patient data must remain protected for decades, while medical devices can take years to upgrade or replace. Healthcare organizations therefore need to assess cryptographic risks, prioritize upgrades, and implement additional safeguards for systems that cannot be made PQC-capable in the near term._