HHS and ASPR signal coming post-quantum guidance for hospitals
3 SEPTEMBER 2026, WASHINGTON
HHS and its Administration for Strategic Preparedness and Response, ASPR, signalled on 3 September 2026 that post-quantum guidance for hospitals is coming. ASPR said it is working with partners on the guidance. The current resilience guidance, known as RISC 2.0, still contains no post-quantum content, so the signal points to future guidance rather than a published document.
Healthcare has a strong reason to prepare. An earlier HC3 briefing from 2022 noted that health data stays sensitive for decades, which makes it a prime target for harvest-now-decrypt-later. An adversary could record long-lived patient records today and decrypt them once a quantum computer exists, so the exposure is already real even before the guidance lands.
The signal functions as advance notice. Because the guidance is still in development and no binding healthcare post-quantum rule yet exists, healthcare organizations face no current mandate. Treating the signal as a prompt to begin foundational work, rather than waiting for the published guidance, gives them a head start on the slow parts of migration.
Why it matters. The HHS and ASPR signal tells hospitals that post-quantum guidance is on the way, even though current resilience guidance omits it. Given that health data stays sensitive for decades, the harvest-now-decrypt-later risk is pressing for the sector. Healthcare organizations can start cryptographic discovery and inventory now, so they are ready to act on the guidance when ASPR and its partners publish it.