For boards, CISOs, device security leads and data protection officers in healthcare and life sciences
Patient data outlives the encryption that protects it.
In fifteen minutes you will know which patient, genomic and trial records are already exposed, what HIPAA, the FDA, EU MDR and NIS2 let a regulator ask for, and the first 90 days of a post-quantum plan your board can sign off.
Step 1 of 5
The attacker does not wait for a quantum computer. They copy your encrypted traffic and backups now and read them when one arrives. A bank statement from 2026 will be stale by then. A child's medical history, a maternity record or a whole-genome sequence will not. Healthcare keeps data longer than almost any other sector, and the people in those records are still alive when the cryptography fails.
| Record type | Typical retention | Confidential until, if created in 2026 |
|---|---|---|
| GP patient records, England (NHS Records Management Code of Practice) | 10 years after the patient's death | The patient's lifetime plus 10 years |
| Maternity records, England (NHS code) | 25 years after the birth of the last child | 2051+ |
| Whole-genome sequences and biobank data | No end date: a genome does not change, and it describes the patient's relatives too | Indefinitely |
| Clinical trial master file (EU Clinical Trials Regulation, Article 58) | At least 25 years after the end of the trial | 2051+ for a trial ending in 2026 |
| US adult medical records (state law; hospitals keep at least 5 years under 42 CFR 482.24) | Commonly 7 to 10 years from last treatment, longer for minors | 2033 to 2045+ |
| Medicare Advantage plan records (42 CFR 422.504(d)) | 10 years | 2036+ |
| Medical device technical documentation (EU MDR Article 10(8)) | 10 years after the last device is placed on the market, 15 years for implantables | 2036 to 2041+, longer while the product line still sells |
Retention rules from the NHS England Records Management Code of Practice, Regulation (EU) 536/2014, 42 CFR and Regulation (EU) 2017/745, linked in the library below. The patient and genomic data workshop works through your own record types. Read the HIPAA analysis for the US position.
An imaging system, infusion pump or implant bought in 2026 is often still in clinical use in 2040, running the cryptography it shipped with.
You will know which device families can change algorithm in the field, which must be bought crypto-agile, and which need ring-fencing until they retire.
Patient portals, FHIR APIs and exchange gateways face the internet and carry the records with the longest lives. The cryptography inside a hosted EHR belongs to the vendor, not to you.
You will know which external interfaces move to hybrid key exchange first, and which vendor roadmap sets your timeline.
Genomes never expire, trial master files last 25 years and a formulation or a trial result is worth copying the day it is created.
You will know which archives to re-encrypt or move behind quantum-safe keys first, and how to sign regulatory submissions so they still verify in 2040.
Free readiness check
Eight questions mapped to what a HIPAA auditor, a NIS2 competent authority, a notified body or your board can ask about quantum risk. You get a score, your top three priorities and the next step that closes your biggest gap. Nothing is sent anywhere.
Start the checkStep 2 of 5
NIST publishes FIPS 203, 204 and 205. NIS2 transposition deadline passes on 17 October.
HHS proposes mandatory encryption of ePHI, an asset inventory and a network map. The NCSC publishes its 2028, 2031 and 2035 timeline.
FDA guidance asks for cryptography that stays strong for the device's service life. The EU roadmap asks organisations to start.
The NCSC expects you to know your cryptography and have a plan.
EU target for high-risk systems. NIST deprecates 112-bit RSA and ECC. EHDS cross-border exchange is live from March 2029.
NIST disallows them. EU and NCSC timelines end here, while devices bought today are still on the ward.
You show: A Security Rule risk analysis that lists harvest now, decrypt later exposure for long-lived ePHI, and the migration plan that answers it.
You show: A technology asset inventory and a map of how ePHI moves, with the cryptography on each link recorded.
You show: For devices you make: algorithms current to 2035 and a path to update them. For devices you buy: procurement language that asks for the same.
You show: An encryption policy that names quantum cryptanalysis and the NIST standards, approved by the management body, and device documentation that treats information security as state of the art across the life cycle.
NHS organisations. The Data Security and Protection Toolkit (2026-27, version 9) is the annual assessment every organisation with access to NHS patient data must complete, with CAF-aligned audit guidance. Neither it nor the DHSC cyber security strategy for health and social care to 2030 names post-quantum cryptography yet, so the NCSC timeline sets the pace: discovery by 2028, priority migration by 2031, done by 2035. Trusts that hold genomic or paediatric data should treat 2028 as the deadline for knowing where it is encrypted and by what. Read the NCSC guidance explained or see our workshops for healthcare teams.
Section 524B applies to any device with software that can connect to the internet. The February 2026 FDA guidance adds the test that matters for quantum: cryptography expected to stay strong for the service life, and nothing on the NIST SP 800-131A deprecated list. With RSA and ECC deprecated after 2030, a device filed in 2027 with a ten-year life needs ML-KEM and ML-DSA in its design, or a documented way to update. In the EU, MDR Annex I section 17.2 and MDCG 2019-16 ask for information security to the state of the art across the life cycle. Medical device and IoMT workshop.
Regulation (EU) 536/2014 Article 58 keeps the trial master file for at least 25 years after a trial ends. US submissions under 21 CFR Part 11 rely on electronic signatures that must still verify when a regulator reopens the file. Both point the same way: trial archives and regulatory submissions need quantum-safe encryption and ML-DSA or SLH-DSA signatures before anything else in the estate. Clinical trial data workshop.
Health plans are HIPAA covered entities in their own right, and Medicare Advantage organisations keep records for 10 years under 42 CFR 422.504(d). Claims clearinghouses and eligibility links move ePHI between hundreds of counterparties, so a payer's migration is set by the slowest provider and clearinghouse on the network, which makes the vendor questionnaire the first task, not the last.
EHDS obliges EHR systems and member state infrastructures to exchange patient summaries and ePrescriptions across borders from March 2029, with images, lab results and discharge reports following in 2031 and genomic data entering secondary use the same year. Infrastructure built between now and 2029 should be built on hybrid post-quantum key exchange from the first design review, because its data lives for decades. EHR PQC migration workshop.
Public post-quantum work across the sector, so you can benchmark where your organisation stands.
Told the Health IT Summit it is about to release post-quantum migration guidance for hospitals and public health organisations, and that inventorying data and systems is the preparation to start now.
Source: GovCIO Media →Reissued its premarket cybersecurity guidance with recommendations under section 524B, asking for cryptography expected to remain strong throughout the service life of the device.
Source: FDA →Simulated a key step of a Suzuki-Miyaura reaction, used in small-molecule drug synthesis, on a hybrid quantum and GPU stack and reported a more than 20-fold improvement in time to solution over earlier benchmarks. Vendor-reported, not independently verified.
Source: IonQ →Urged hospitals to build a quantum-readiness roadmap covering cryptographic inventories, vendor relationships and supply chain, after CISA, the NSA and NIST published their quantum-readiness factsheet.
Source: AHA →Announced it would incorporate post-quantum cryptography protocols into its network, among the first health systems to do so, starting with discovery of the software that needs updating.
Source: SandboxAQ →Step 3 of 5
For budget ranges, see our PQC migration cost benchmarks. For a plan built around your trust, hospital group or product line, see the healthcare workshops.
Need help delivering the plan? Our expert members are peer-reviewed suppliers, integrators and advisers. Meet the expert members →
Step 4 of 5
A migration succeeds or stalls on people. In healthcare that means the programme lead, the board, the security team and clinical engineering working from one plan.
$1,450 a seat · $1,087.50 for members
QSECDEF training · CPQCPM
Your brochure, the next cohort dates and the costs are ready on the next page.
Certified Quantum Business Professional
Self-paced, no physics background. Covers PQC, policy and PQC risk and migration management.
Free first session · included in membership
Get Session 1 freeIntroduction to Quantum Cyber Security
Six modules, 4 to 5 hours, certificated.
Free first module · included in membership
Get Module 1 freeAI Security and Resilience Leadership Bootcamp
Ten weeks, live, with the CASRP credential.
Live sessions free to attend
Join the free live sessions
Team membership brings your board, programme lead, security team and clinical engineers up to speed together, tracks what each person has completed and certifies across the group. The three courses above are included, plus 170+ expert lectures and the weekly call, and members pay less for CPQCPM.
See team membershipStep 5 of 5
A members-only structured Q&A for executives, CISOs, device product security leads and data protection officers at hospital groups, health systems, insurers, genomics organisations, device makers and pharmaceutical companies. It runs under the Chatham House Rule and is facilitated by Anna Beata Kalisz Hedegaard, Founder of QSECDEF.
Practitioner lectures from the QSECDEF library that matter most to healthcare and life sciences: a sober read on the threat, how to run a migration programme, how to protect data and devices, and what quantum computing can and cannot yet do for research.
Expert Membership
Expert membership brings you into an open community working across sectors, opening up industry conversations, knowledge and access to experts. If you are building technology or consulting capabilities in this sector relevant to Quantum or Advanced AI, we want to hear from you.
Not by name. The Security Rule requires technical safeguards that are reasonable and appropriate, and an accurate and thorough risk analysis under 45 CFR 164.308(a)(1)(ii)(A). HHS guidance points to NIST publications for what counts as appropriate encryption, and NIST IR 8547 deprecates RSA and ECC after 2030. The proposed rule of January 2025 would make encryption of ePHI mandatory with limited exceptions and require a technology asset inventory and network map. A risk analysis that ignores harvest now, decrypt later for long-lived ePHI is hard to defend as thorough.
Section 524B of the FD&C Act, in force since 29 March 2023, requires premarket submissions for cyber devices to include a plan for postmarket vulnerabilities, reasonable assurance of cybersecurity and a software bill of materials. The premarket cybersecurity guidance reissued on 3 February 2026 recommends NIST-current cryptography that is expected to stay strong throughout the service life of the device, and no algorithms that are deprecated or disallowed under NIST SP 800-131A. For a device with a ten-year life filed from 2027, that points at ML-KEM and ML-DSA or a documented update path.
A genome does not change, cannot be re-issued like a password, and describes the patient's relatives as well as the patient. Its confidentiality requirement has no end date, so any finite estimate of when a cryptographically relevant quantum computer arrives puts genomic data inside the harvest now, decrypt later window. Biobanks, national genomics programmes and research archives encrypted with RSA or ECC today should be re-encrypted or moved behind quantum-safe keys before anything else in the estate.
The EU roadmap targets high-risk use cases by the end of 2030 and as many systems as feasible by 2035. NIST IR 8547 deprecates 112-bit RSA and ECC after 2030 and disallows them after 2035. The UK NCSC sets milestones at 2028, 2031 and 2035. Healthcare has a twist: a device bought in 2026 may still be on the ward in 2040, so procurement has to change years before the deadlines do.
Yes. Annex I of the NIS2 Directive lists the health sector among sectors of high criticality, including healthcare providers, EU reference laboratories, research and development of medicinal products, manufacturers of basic pharmaceutical products and manufacturers of medical devices considered critical during a public health emergency. Article 21(2)(h) requires policies on cryptography and encryption, and Article 20 makes management bodies approve and oversee the measures. Member states had until 17 October 2024 to transpose it.
There is no NHS-specific post-quantum mandate yet. The Data Security and Protection Toolkit assesses organisations against the National Data Guardian's standards with CAF-aligned audit guidance, and the DHSC cyber security strategy runs to 2030 without naming quantum. The NCSC timeline is the operative guidance for NHS organisations: discovery and a plan by 2028, high-priority migration by 2031, completion by 2035. GP records kept for ten years after death and maternity records kept for 25 years make the 2028 discovery date the one to plan around.
With three things: a cryptographic inventory of the systems that hold or move ePHI and of the connected device fleet, a map of which record types must stay confidential past 2030, and a written post-quantum roadmap from the EHR vendor and the cloud host behind it. Those three give the board the evidence to set priorities, and they are what the proposed HIPAA rule and NIS2 Article 21 already point towards.
It is real as research and not yet as a production tool. In June 2025 IonQ, AstraZeneca, AWS and NVIDIA simulated a step of a Suzuki-Miyaura reaction on a hybrid quantum and GPU stack and reported a more than 20-fold improvement in time to solution, a vendor-reported figure. Current hardware handles small active spaces, and no vendor offers fault-tolerant quantum chemistry for candidate screening. Boards should fund evaluation, not procurement, and keep the security migration on a separate budget line.
Five numbers: inventory coverage of ePHI systems and the device fleet, the records and patient counts that must stay confidential beyond 2030, how many EHR, cloud and device suppliers have a post-quantum roadmap on file, how many connected devices can change algorithm in the field or retire before 2035, and budget and milestones against the 2030 and 2035 deadlines.
Everything on this page. The two-minute readiness check scores your healthcare and life sciences programme and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the Q-Day Timeline Risk Calculator, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.
It depends on the role. Board and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, IT and clinical engineering teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. GRC, privacy and compliance leads take AI Security and Resilience Leadership Bootcamp, twenty live online lectures connecting AI security, resilience and post-quantum readiness. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.
Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your GRC, privacy and clinical engineering teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.
Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.
Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving healthcare and life sciences who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.
No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.
CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The healthcare workshops are full-day sessions, in person or online.
The free weekly call runs every Tuesday at 15:00 CET. Bring your question.
Join the Tuesday call →For your organisation
When your board, programme team, notified body or auditor needs something specific, we shape the workshop, the training or the engagement around your systems, your regulators and your timeline. Independent of any vendor.
Facilitated sessions for boards, audit and risk committees and clinical technology leadership, built on your own record types, device fleet, obligations and 2030 plan.
Private CPQCPM cohorts, live online or in person, with the seven healthcare workshops for EHR migration, device security, trial data and genomic data, and team membership for the self-paced courses.
Cryptographic inventory, PQC migration planning, EHR and device vendor review and specialist teams sourced from 1,500+ members across 900+ organisations.
Prefer email? Write to info@qsecdef.com and tell us about your timeline.
Photos: Pexels (Marlon Castor, MART PRODUCTION, cottonbro studio, Elements Interactive, Odin Reyna, Enrique Silva, Thirdman) and QSECDEF, converted to black and white or brand duotone.
