Healthcare systems now confront a serious vulnerability from quantum computing, a technology that could compromise encryption shielding patient records, yet most organizations have not yet addressed the threat. According to a recent analysis, just 6% of medical devices—including infusion pumps and diagnostic equipment—feature security measures strong enough to resist quantum attacks, while 50% of traditional IT systems already meet those standards. This disparity endangers electronic health records, medical imaging files, and lab results, which often retain sensitive details for decades.
Quantum computers, which exploit quantum mechanics for faster processing, could soon surpass classical systems in handling complex calculations. Though still under development, functional quantum machines may emerge within the next few years, demanding a shift to post-quantum cryptography, encryption methods built to withstand both current and future cyber threats. The urgency stems from a growing risk: attackers may already be collecting encrypted healthcare data today, planning to decrypt it later once quantum computing reaches practical capability.
A review of 2.5 million devices across 50 healthcare organizations highlighted the security gap. Medical devices, often critical to patient care, lag behind IT infrastructure in security upgrades. Only 31% of internet-facing healthcare systems, such as patient portals and administrative networks, currently support encryption protocols adaptable to post-quantum standards. The difficulty of updating legacy medical hardware, many of which are decades old, further complicates the transition.
Cyber threats to healthcare providers have escalated sharply. Between January and August, there were 461 publicly reported ransomware incidents worldwide, marking a 47% rise compared to the same period the prior year. Over 60% of those attacks targeted U.S.-based organizations. The financial impact of breaches has grown severe, with the average cost per incident now exceeding $6.64 million, according to industry reports.
Security specialists caution that postponing preparations will only increase exposure. Daniel Trivellato, vice president of operational technology at Forescout, described the “harvest now, decrypt later” tactic as a primary concern. Cybercriminals may be storing encrypted medical records today, betting that quantum decryption will become feasible in the coming years. Since healthcare data, such as prescriptions, diagnostic images, and treatment histories, often remains valuable for decades, it presents a long-term target for exploitation.
Trivellato advised healthcare leaders that the decision is not between immediate action and inaction, but rather about integrating quantum-resistant measures into existing technology refresh cycles. He recommended prioritizing high-risk systems and assets first, using frameworks like those developed by the National Institute of Standards and Technology (NIST), which has established post-quantum cryptography standards. Regulatory uncertainty persists, however. While NIST has established technical benchmarks, it remains unclear whether healthcare will face specific post-quantum cryptography requirements or if compliance will be absorbed into broader cybersecurity regulations. The absence of clear mandates could delay adoption, leaving organizations exposed as quantum computing advances.
