Healthcare organisations handle some of the most persistent and sensitive personal data of any sector. A patient’s medical history does not expire. Genomic data remains sensitive for a lifetime and beyond, given its implications for biological relatives. Mental health records, oncology histories, HIV status: these categories carry social and practical consequences that do not diminish with time. The quantum security challenge for healthcare is therefore not just a technology problem. It is a data protection obligation that will outlast any equipment lifecycle.
The core issue is straightforward once you see it. Most health data is encrypted in transit using TLS with classical key exchange. If that traffic has been or is being intercepted by a sophisticated adversary, the encrypted records are sitting in a database somewhere. When a quantum computer capable of running Shor’s algorithm is eventually built, those records become readable. For ordinary web traffic, that future exposure may be acceptable. For a patient’s genomic sequence or psychiatric history, it is a different matter entirely.
Nation-state actors have demonstrated persistent interest in health data. The 2015 Anthem breach, affecting nearly 79 million records and attributed to Chinese state-sponsored actors, was not a ransomware opportunist. It was targeted collection at scale. HNDL extends the same threat model to encrypted data in transit, collected not by breaking in but by intercepting traffic on the network.
The connected device problem
Modern healthcare runs on a vast ecosystem of connected medical devices. Infusion pumps, imaging systems, patient monitors, implantable devices, remote diagnostics platforms. These devices typically have embedded cryptographic implementations with long replacement cycles, limited update mechanisms, and often hardcoded algorithms that were chosen when the device was designed, potentially a decade ago.
A CT scanner installed today may still be in clinical use in 2038. If its TLS implementation cannot be updated and uses classical key exchange, it will be cryptographically vulnerable for its entire operational lifetime. This is a structural problem that cannot be fully solved after the fact. Healthcare organisations should begin requiring post-quantum cryptographic roadmap commitments from medical device manufacturers in all new procurement.
GDPR and the healthcare context
Health data is classified as a special category under GDPR Article 9, requiring enhanced protection. Article 32 requires organisations to implement appropriate technical measures to ensure data security, taking into account the state of the art. As post-quantum standards mature and the HNDL threat becomes more widely understood, that phrase will carry increasing weight when applied to health data protection.
Data protection authorities across the EU are becoming more technically sophisticated. The intersection of HNDL risk and special category health data creates a specific compliance exposure. It is not yet a formal regulatory requirement to deploy post-quantum cryptography for health data. But the direction of travel is clear.
Where to focus first
Electronic health record systems are the obvious starting point. They hold the most sensitive data and have the most direct exposure to HNDL attacks through their TLS connections. Health information exchanges, which connect hospitals, laboratories, pharmacies, and insurers, are often overlooked because they are infrastructure rather than applications, but they carry significant volumes of sensitive data across organisational boundaries.
Genomic data platforms deserve particular attention. Genomic information is indefinitely sensitive, it is transmitted and processed in ways that often traverse external networks, and the volume of genomic data being generated is growing rapidly. Any genomic data transmitted today under classical encryption should be considered potentially exposed if a quantum computer eventually arrives.