[{"data":1,"prerenderedAt":134},["ShallowReactive",2],{"news-\u002Fnews\u002Fhealthcare-medical-devices-long-lived-records-pqc":3},{"id":4,"title":5,"author":6,"authorTitle":7,"authorUrl":8,"body":9,"canonical":8,"category":88,"date":89,"description":90,"draft":91,"extension":92,"faqs":8,"findingsSource":8,"geo":93,"image":8,"industries":95,"keyFindings":8,"meta":98,"modified":99,"navigation":100,"path":101,"pullquote":8,"recommendations":8,"references":102,"related":115,"seo":122,"seoTitle":123,"signposts":8,"slug":124,"stats":8,"stem":125,"tags":126,"tldr":132,"__hash__":133},"news\u002Fnews\u002Fhealthcare-medical-devices-long-lived-records-pqc.md","Medical Device Makers and Health Systems Weigh Post-Quantum Plans for Decades-Long Records","ArcQubit Team","",null,{"type":10,"value":11,"toc":79},"minimark",[12,17,21,25,39,43,54,58,65,69,72,76],[13,14,16],"h2",{"id":15},"the-answer-up-front","The answer, up front",[18,19,20],"p",{},"Medical device makers and health systems face a migration shaped by two facts: regulators are setting 2030 and 2035 milestones, and patient records need decades of protection. That combination makes harvest-now-decrypt-later an active concern, not a future one. The current reporting leans on vendor-authored pieces and a preprint, so the claims below should be read as viewpoints and estimates rather than settled fact, but the direction is consistent with the government timelines that anchor it.",[13,22,24],{"id":23},"devices-and-deadlines","Devices and deadlines",[18,26,27,28,32,33,35,36,38],{},"Two Medcrypt authors wrote in October 2025 that medical device encryption could be broken within a few years to a decade and that regulators are setting deadlines ",[29,30,31],"span",{},"1",". They say NIST will deprecate RSA and ECC by 2030 and phase out legacy algorithms by 2035, that the EU expects high-risk systems to reach post-quantum cryptography by the end of 2030 and medium and low risk by 2035, and that the FDA's June 2025 guidance asks for current NIST-recommended cryptography without naming a post-quantum approach ",[29,34,31],{},". They advise crypto agility and a cryptography bill of materials ",[29,37,31],{},". Medcrypt sells device cybersecurity, so these are vendor claims.",[13,40,42],{"id":41},"the-uk-clock-applied-to-health","The UK clock applied to health",[18,44,45,46,49,50,53],{},"In the United Kingdom, the National Cyber Security Centre set three milestones in March 2025: complete discovery of cryptography-dependent systems by 2028, finish high-priority migration by 2031, and complete full migration by 2035 ",[29,47,48],{},"2",". A July 2025 post from an IT services vendor applies that clock to the NHS, treating harvest-now-decrypt-later as an active threat to stolen patient data, noting that patient records need decades of protection, and naming legacy trust middleware as the main readiness obstacle ",[29,51,52],{},"3",". That post is vendor marketing, so weigh its framing accordingly, but the NCSC dates behind it are primary.",[13,55,57],{"id":56},"device-constraints","Device constraints",[18,59,60,61,64],{},"A December 2024 arXiv preprint on healthcare IoT says pacemakers and glucose monitors run on roughly 32 to 64 KB of RAM and 16 to 32 MHz processors, which complicates post-quantum algorithms, and it discusses interception and device-manipulation risks alongside harvest-now exposure of patient data ",[29,62,63],{},"4",". As read, the preprint is not peer reviewed, so its specifics are claims rather than confirmed findings, though the constraint it describes is real and widely acknowledged.",[13,66,68],{"id":67},"what-this-means-for-healthcare-organizations","What this means for healthcare organizations",[18,70,71],{},"Retention is the planning fact. A record created today may need to stay confidential for a lifetime, which is exactly what makes harvest-now exposure present rather than future. Health systems and device makers should inventory where vulnerable cryptography protects long-lived records and devices, prioritize by sensitivity and retention, and build crypto agility and a cryptography bill of materials into device design and procurement.",[13,73,75],{"id":74},"how-arcqubit-approaches-it","How ArcQubit approaches it",[18,77,78],{},"ArcQubit treats the cryptographic inventory as the first deliverable. QuCode discovers where vulnerable cryptography sits across records, devices and cloud platforms, and QuTrust holds the migration plan so a health system can show a current, defensible posture as FDA, NCSC and EU timelines bite.",{"title":7,"searchDepth":80,"depth":80,"links":81},2,[82,83,84,85,86,87],{"id":15,"depth":80,"text":16},{"id":23,"depth":80,"text":24},{"id":41,"depth":80,"text":42},{"id":56,"depth":80,"text":57},{"id":67,"depth":80,"text":68},{"id":74,"depth":80,"text":75},"Analysis","2025-10-01","Vendors and regulators point to 2030 and 2035 milestones for healthcare cryptography. Patient records need decades of protection, so harvest-now risk is active today.",false,"md",[94],"us",[96,97],"Cross-Sector","Healthcare and Public Health",{},"2026-09-12",true,"\u002Fnews\u002Fhealthcare-medical-devices-long-lived-records-pqc",[103,106,109,112],{"label":104,"url":105},"N. Schwartz and A. Wirth, \"Medical device manufacturers need to act now on post-quantum cryptography,\" Medical Design and Outsourcing, Oct. 1, 2025.","https:\u002F\u002Fwww.medicaldesignandoutsourcing.com\u002Fmedical-device-encryption-post-quantum-cryptography\u002F",{"label":107,"url":108},"UK National Cyber Security Centre, \"Setting direction for the UK's migration to post-quantum cryptography,\" NCSC blog, Mar. 20, 2025.","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fsites\u002Fdefault\u002Ffiles\u002Fpdfs\u002Fblog\u002Fsetting-direction-uk-migration-to-pqc.pdf",{"label":110,"url":111},"E. Davidson, \"Quantum computing and healthcare cybersecurity: why NHS leaders must act now,\" Celerity UK, Jul. 23, 2025.","https:\u002F\u002Fwww.celerity-uk.com\u002Fresources\u002Fquantum-computing-and-healthcare-cybersecurity-why-nhs-leaders-must-act-now",{"label":113,"url":114},"A. Alif, K. F. Hasan, J. Laeuchli, and M. J. M. Chowdhury, \"Quantum threat in healthcare IoT: challenges and mitigation strategies,\" arXiv:2412.05904, Dec. 2024.","https:\u002F\u002Farxiv.org\u002Fpdf\u002F2412.05904",[116,119],{"label":117,"url":118},"A US Health Agency Signals Post-Quantum Guidance for Hospitals","\u002Fnews\u002Fhhs-aspr-healthcare-post-quantum-guidance",{"label":120,"url":121},"Harvest Now, Decrypt Later: The Threat Explained","\u002Fblog\u002Fharvest-now-decrypt-later",{"title":5,"description":90},"Health Systems Weigh Post-Quantum Plans","healthcare-medical-devices-long-lived-records-pqc","news\u002Fhealthcare-medical-devices-long-lived-records-pqc",[127,128,129,130,131],"healthcare","harvest now decrypt later","NCSC PQC timelines","crypto-agility","quantum readiness","Vendors and regulators are converging on 2030 and 2035 milestones for healthcare cryptography, and because patient records need decades of protection, harvest-now-decrypt-later is an active concern even though much of the current reporting is vendor-authored.","nTffFgiCZRHSoXa8Z1PyG934Qx9xkURGZmY3PlFAcPY",1792182886300]