Healthcare
Assess long-lived health data, clinical identities, connected devices, EHR integrations, and vendor lifecycles.
Sector-readiness guidance — not an audit, certification, or deployment claim
Quantum-readiness priorities for Healthcare
Healthcare environments use cryptography to protect long-lived health records, patient and workforce identities, portals, telehealth, data exchange, software updates, connected devices, and cloud services. Some health information may need confidentiality and integrity protection for many years.
A readiness assessment should map EHR and interoperability connections, certificate and identity infrastructure, device and firmware lifecycles, vendor-managed services, archives, and research-data flows. Systems that cannot be updated quickly need clear ownership, compensating plans, and vendor questions.
Migration work must respect clinical continuity, safety review, supported protocols, device constraints, and evidence requirements. A laboratory prototype or vendor roadmap is not proof that a production healthcare environment is fully protected or compliant.
Readiness priorities
Find long-lived dependencies
Inventory records, identities, portals, exchanges, devices, certificates, archives, and vendor-managed cryptography.
Assess lifecycle risk
Prioritize by data lifetime, clinical criticality, device support, vendor timelines, and operational change limits.
Protect continuity during change
Test interoperability, performance, safety boundaries, deployment sequencing, and rollback in controlled environments.
Standards and limitations
These profiles use NIST's inventory, risk-prioritization, crypto-agility, and controlled-interoperability approach. The status of each reference is stated explicitly.
NIST FIPS 203, 204, and 205
Current standardized ML-KEM, ML-DSA, and SLH-DSA algorithms; application and protocol support must still be verified.
NIST CSWP 39upd1 — Crypto Agility
Guidance for environment-specific cryptographic change while preserving security and ongoing operations.
NIST IR 8547 — PQC Transition
Draft transition context, presented separately from final standards and implementation requirements.
These are sector-readiness profiles, not audits, certifications, threat guarantees, or evidence of completed deployments. Findings and migration choices depend on each organization's systems, data, vendors, protocols, and operating environment.
Standards and guidance last reviewed: 5 August 2026.