The answer, up front
Hospitals and public health organizations face no post-quantum requirement today, but federal guidance is coming, and the exposure is already real. On September 2, 2026, a senior cybersecurity advisor at the HHS Administration for Strategic Preparedness and Response (ASPR) said the office was working with private sector partners and about to release guidance on preparing for and mitigating quantum-related threats 1. It had not been published as of early October 2026, and no release date was given 1. The reason the sector should not wait is simple: health records stay sensitive for decades, so data copied today can be decrypted later once a capable quantum computer exists.
What ASPR signaled
GovCIO Media reported remarks from ASPR advisor Bob Bastani that the office would release guidance documents soon 1. The same report notes that ASPR's updated RISC 2.0 assessment tool currently carries no post-quantum guidance, though it includes cybersecurity assessments, and it advises organizations to inventory data and systems as a preparatory step 1. ASPR is developing the guidance with industry partners, which suggests it will reflect how hospitals actually run their systems rather than a purely theoretical model.
Federal advisors flagged this in 2022
This is not a new concern for the health sector. In July 2022 the HHS Health Sector Cybersecurity Coordination Center (HC3) issued a threat briefing, "Quantum Cryptography and the Health Sector," explaining how quantum computers could undermine current encryption 2. It stressed that healthcare organizations hold sensitive data across electronic health records, mobile devices, cloud platforms and wireless medical equipment, and it recommended a cross-functional working group, quantum risk evaluations to find vulnerable data stores and transmissions, an inventory of data sensitivity and retention, and integration of mitigation into risk management plans 2. It said there was no immediate threat but that the work needs time and resources, so organizations should begin planning 2.
Why the data lifetime matters
The defining fact for healthcare is retention. A patient record created today may need to stay confidential for the rest of a person's life. That long shelf life is exactly what makes harvest-now-decrypt-later a present exposure rather than a future one: an attacker does not need to read the data today, only to store it until a quantum computer can break the cryptography protecting it. NIST finalized its first post-quantum standards in August 2024, so named algorithms now exist for organizations ready to begin 3.
What this means for healthcare organizations
Hospitals, health systems and health IT providers should expect federal guidance soon and can act before it arrives. The inventory and working group steps described in the 2022 HC3 briefing are available now and do not depend on new guidance 2. The practical sequence is to find where quantum-vulnerable cryptography protects long-lived patient data, rank those stores by sensitivity and retention, and start planning migration.
How ArcQubit approaches it
ArcQubit treats the cryptographic inventory as the first deliverable, because a health system cannot protect data it cannot locate. QuCode discovers where vulnerable cryptography sits across records, devices and cloud platforms, and QuTrust holds the migration plan so the organization can show a current, defensible posture when federal guidance and auditors arrive.