Sign in Subscribe
compliance

PQC and HIPAA: What Healthcare Compliance Officers Must Do Before the Security Rule Rewrites the Rules

PQC and HIPAA: What Healthcare Compliance Officers Must Do Before the Security Rule Rewrites the Rules

You are already behind on one encryption overhaul. The proposed HIPAA Security Rule rewrite will convert previously "addressable" ePHI encryption safeguards into hard requirements — and the target finalization date is May 2026.[Federal Register, HIPAA Security Rule NPRM, 2024] If your organization is rebuilding cryptographic controls to meet that mandate and you are not simultaneously evaluating post-quantum readiness, you are engineering a second, costlier migration for yourself — one that regulators have not yet demanded but that adversaries have already started exploiting.

This is the compliance officer's dilemma: zero primary HHS guidance links post-quantum cryptography to HIPAA as of March 2026. No OCR bulletin. No Federal Register notice. No enforcement FAQ. Yet NIST finalized its first three post-quantum cryptographic standards — FIPS 203, FIPS 204, and FIPS 205 — in August 2024.[NIST, FIPS 203, 2024] The regulatory silence is not permission to wait. It is a liability gap that will compound every quarter you delay.

The HIPAA Security Rule Is Being Rewritten — Here Is What Changes

The 2024 Notice of Proposed Rulemaking published by the HHS Office for Civil Rights represents the most significant restructuring of the HIPAA Security Rule since it took effect in 2005.[Federal Register, HIPAA Security Rule NPRM, 2024] For compliance officers who have managed the existing framework for years, the architecture of the proposed rule is a fundamental shift — not a tune-up.

The most consequential structural change is the elimination of the "addressable" specification category for encryption. Under the current rule, covered entities can decline to implement an addressable specification if they document a reasonable alternative or determine it is not appropriate to their environment.[HHS, HIPAA Security Rule Overview] The proposed rule removes this flexibility for ePHI encryption at rest and in transit, converting it into a mandatory requirement. For organizations that have historically documented their way out of full encryption deployment, this is not a paperwork update — it is a hard infrastructure obligation.

Beyond encryption, the proposed rule introduces additional requirements that directly affect how compliance officers plan cryptographic programs. These include mandatory multi-factor authentication for all access to ePHI systems, formal technology asset inventories updated at least annually, mandatory network segmentation, and required penetration testing on a defined cadence.[Federal Register, HIPAA Security Rule NPRM, 2024] Each of these requirements creates a natural integration point for quantum risk assessment — but only if compliance officers build that scope into their planning now.

The regulatory environment is also volatile in ways that make passive monitoring a poor strategy. The Carmen Purl v. HHS litigation (N.D. Tex., June 18, 2025) struck reproductive health privacy provisions while upholding Part 2 NPP requirements — a reminder that compliance officers are simultaneously managing judicial challenges, the February 16, 2026 hard deadline for NPP updates under the 42 CFR Part 2 Final Rule,[Federal Register, 42 CFR Part 2 Final Rule, 2024] and a Security Rule rewrite on a parallel track. The organizations that will navigate this successfully are those that treat May 2026 as a planning forcing function — not a deadline they will address in April 2026.

Why the Quantum Threat Is a HIPAA Problem, Not Just an IT Problem

"Harvest now, decrypt later" is not a hypothetical attack scenario. It is a documented adversarial strategy in which threat actors capture encrypted data today — at the cost of storage, not decryption — and archive it for decryption once a cryptographically relevant quantum computer becomes available.[CISA, Post-Quantum Cryptography Initiative] For healthcare compliance officers, this framing reframes the quantum question entirely: the threat is active now, even before quantum computing achieves the capability to break current encryption.

Healthcare data is among the highest-value targets for this attack pattern for reasons that are structural, not incidental. Federal law requires medical records to be retained for a minimum of six years from creation or last use.[HHS, HIPAA Security Rule Overview] State laws frequently extend that window to 10 years for adults and 21 years for minors — meaning ePHI encrypted today under current standards will remain in systems, archives, and backup tapes well into the 2040s. Genomic data, insurance histories, and longitudinal patient records carry retention obligations that are effectively permanent in clinical practice. The intersection of high sensitivity, long retention, and high adversarial motivation makes healthcare ePHI a priority harvest target regardless of where quantum computing timelines ultimately land. Understanding this exposure pattern is why each month of delayed PQC action represents an irreversible security decision — archived ciphertext cannot be retroactively re-encrypted.

Compliance officers who frame this as an IT procurement question will miss the governance dimension. When a breach of archived ePHI occurs after a quantum decryption event — even years from now — OCR and plaintiffs' counsel will ask what the organization knew, when it knew it, and what risk management decisions were made in response. NIST published its migration guidance and finalized its first PQC standards in 2024. That record is now part of the "reasonable and appropriate" standard under which HIPAA compliance decisions are evaluated. Documenting why your organization chose not to assess quantum risk after 2024 is a significantly harder audit position than documenting a phased, resource-constrained migration plan.

The Regulatory Gap — What NIST Has Done That HHS Has Not Yet

The contrast between NIST's completed work and HHS's current guidance is stark. In August 2024, NIST finalized three post-quantum cryptographic standards: FIPS 203 (ML-KEM, a key encapsulation mechanism for key exchange),[NIST, FIPS 203, 2024] FIPS 204 (ML-DSA, a lattice-based digital signature algorithm),[NIST, FIPS 204, 2024] and FIPS 205 (SLH-DSA, a stateless hash-based signature scheme).[NIST, FIPS 205, 2024] These are not draft guidelines or discussion documents — they are finalized federal standards available for immediate implementation planning.

NIST's National Cybersecurity Center of Excellence has also published SP 1800-38, an ongoing migration practice guide specifically addressing cryptographic agility and the transition to post-quantum standards.[NIST NCCoE, SP 1800-38, Crypto Agility Considerations] CISA has published its Post-Quantum Cryptography Initiative with sector-specific implementation resources.[CISA, Post-Quantum Cryptography Initiative] The federal standards infrastructure for PQC migration is in place. What is absent is any HHS or OCR document that connects these standards to HIPAA obligations.

This gap has a practical implication that compliance officers must communicate clearly to leadership: "no HIPAA mandate for PQC" does not mean "no HIPAA risk from quantum threats." The HIPAA Security Rule's risk analysis requirement at 45 CFR § 164.308(a)(1) requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI.[HHS, HIPAA Security Rule Overview] That standard is technology-neutral and threat-agnostic. A risk analysis conducted in 2025 or 2026 that omits quantum threat modeling — given publicly available NIST standards and documented adversarial harvesting behavior — is increasingly difficult to defend as "accurate and thorough" under OCR scrutiny. Understanding how NIST has characterized ML-KEM, ML-DSA, and the broader finalized PQC standard set is the minimum technical literacy compliance officers need to engage their security teams on this question.

Conducting a Quantum Risk Assessment Under HIPAA's Existing Framework

The absence of PQC-specific HIPAA guidance does not mean compliance officers must wait for a new framework. The existing HIPAA risk analysis structure — when applied with current threat intelligence — provides a defensible methodology for documenting quantum risk today. The key is mapping established NIST and CISA migration guidance onto HIPAA's existing analytical requirements.

Step 1: Cryptographic Asset Inventory

The proposed Security Rule mandates formal technology asset inventories.[Federal Register, HIPAA Security Rule NPRM, 2024] This requirement, which many organizations have not formally implemented, becomes the foundation of quantum risk assessment. A cryptographic inventory documents every system that processes, stores, or transmits ePHI; the encryption protocols and key exchange mechanisms in use; certificate authorities and key management infrastructure; and third-party integrations that involve cryptographic handshakes. NIST NCCoE's SP 1800-38 provides a structured methodology for this inventory process.[NIST NCCoE, SP 1800-38] Compliance officers should treat the HIPAA asset inventory mandate as the forcing function to build this cryptographic layer simultaneously — not as a separate future project.

Step 2: ePHI Classification by Sensitivity and Retention Period

Not all ePHI carries equal quantum risk. Classification should weight two dimensions: data sensitivity (genomic data and mental health records carry higher re-identification and stigmatization risk than routine claims data) and retention period (data retained for 15–21 years under state minor record laws faces a materially different quantum threat window than data retained for six years). This classification exercise maps directly to HIPAA's existing risk analysis requirement to assess the probability and criticality of potential risks to ePHI. Documenting this analysis in the format OCR auditors expect — a written risk analysis with identified threats, likelihood, and impact ratings — positions quantum risk within the existing compliance evidence file rather than creating a parallel, unexplained document.

Step 3: Documenting Quantum Risk for OCR Audit Readiness

OCR does not currently ask for quantum risk documentation. It does ask whether risk analyses are comprehensive, current, and tied to implemented safeguards. Compliance officers should document quantum threat assessment as a named risk category within the existing risk register, referencing NIST's published standards and CISA guidance as the basis for threat identification. Risk treatment decisions — whether to begin hybrid migration, defer implementation pending vendor support, or accept risk with documented rationale — should be recorded with dates and decision-maker identification. This documentation structure means that when OCR guidance on quantum risk eventually arrives, your organization will have an auditable record of proactive risk management rather than a gap. Building the operational capability to manage cryptographic systems through iterative transitions — what practitioners call cryptographic agility — is the structural outcome this documentation process should be building toward.

Business Associates, BAAs, and the PQC Contracting Gap

Business Associate Agreements are the contractual mechanism through which covered entities extend HIPAA obligations to vendors who access, process, or transmit ePHI. The standard BAA template in use across the healthcare industry in 2026 contains no PQC language, no quantum risk representations, and no cryptographic modernization obligations. This is not surprising — HHS has not required such language. It is, however, a downstream liability that compliance officers should begin addressing proactively.

The exposure is specific. When the HIPAA Security Rule finalizes mandatory encryption requirements, covered entities will be obligated to ensure business associates implement equivalent safeguards.[HHS, HIPAA Security Rule Overview] If a business associate — an EHR vendor, cloud hosting provider, medical imaging platform, or clearinghouse — continues using RSA-2048 or ECDH key exchange for ePHI transmission while a cryptographically relevant quantum computer becomes operational, the covered entity shares exposure for that breach. The BAA, as currently drafted, provides no mechanism for the covered entity to audit, demand, or contractually enforce cryptographic modernization at the vendor level.

Compliance officers should initiate three immediate actions on the BAA front. First, issue a vendor questionnaire to all business associates requesting their current cryptographic standards for ePHI systems, their awareness of NIST FIPS 203/204/205, and their internal PQC migration planning status. Second, flag BAA renewal cycles as the opportunity to introduce cryptographic modernization language — specific representations about encryption standards in use, notification obligations if standards change, and a right to audit cryptographic controls. Third, escalate EHR vendor contracts for specific review: EHR platforms process virtually all categories of high-sensitivity ePHI and are among the slowest-moving vendors in the healthcare ecosystem on security infrastructure upgrades. Getting quantum readiness language into EHR contracts during the current Security Rule transition window is significantly easier than attempting to insert it under emergency conditions after a mandate arrives.

The contracting questions compliance officers should be asking of vendors now include: Which encryption algorithms do you use for ePHI at rest and in transit? Have you mapped your cryptographic dependencies against NIST's post-quantum standards? What is your internal timeline for supporting ML-KEM or hybrid TLS configurations? Do you have a cryptographic inventory of your own third-party dependencies that touch our ePHI? These questions do not require a PQC mandate to be reasonable — they reflect the due diligence standard that HIPAA's "reasonable and appropriate" language has always implied.

A Compliance Roadmap — Aligning PQC Migration with the Security Rule Timeline

Compliance officers need a framework they can present to boards, CFOs, and operational leadership that is defensible, resource-realistic, and tied to known regulatory milestones. The following phased roadmap aligns PQC readiness work with the HIPAA Security Rule timeline without requiring organizational resources that are not yet available or vendor support that does not yet exist at scale.

Phase 1: Inventory and Assessment (Now through Q3 2025)

Conduct a formal cryptographic asset inventory covering all ePHI systems. Document current encryption protocols, key exchange mechanisms, and certificate infrastructure. Classify ePHI by sensitivity and retention period. Complete a written quantum risk assessment integrated into the existing HIPAA risk analysis. Issue vendor questionnaires to all business associates. Identify BAA renewal cycles for 2025–2026 as opportunities for cryptographic modernization language. This phase requires no capital expenditure on new technology — it is a documentation and assessment exercise that produces compliance artifacts with immediate audit value.

Phase 2: Planning and Vendor Engagement (Q4 2025 through Q2 2026)

Engage EHR vendors, cloud providers, and clearinghouses on PQC roadmap timelines. Evaluate hybrid cryptographic approaches — systems that run classical and post-quantum algorithms simultaneously — for high-sensitivity ePHI pipelines where vendor support is available.[NIST NCCoE, SP 1800-38] Draft updated BAA language for cryptographic modernization representations. Align this planning work with the mandatory Security Rule compliance preparation that May 2026 finalization will require — so that PQC readiness planning and Security Rule compliance planning share the same project infrastructure, governance structure, and budget request. Present the board with a documented quantum risk posture and a phased remediation timeline before the Security Rule is finalized.

Phase 3: Implementation and Continuous Monitoring (Post-finalization through 2030)

As vendor support for FIPS 203-based key exchange matures, begin transitioning high-sensitivity ePHI systems to hybrid or full post-quantum configurations. Integrate cryptographic monitoring into your existing security operations cadence. Update the written risk analysis annually to reflect the evolving quantum threat timeline, changes in vendor PQC support, and any new HHS or NIST guidance. The organizations that will be positioned well when PQC mandates eventually arrive in healthcare regulation are those that have built the operational infrastructure — inventories, vendor relationships, board-level documentation, and staff awareness — during this pre-mandate window. CISA's guidance explicitly recommends beginning migration planning now rather than waiting for sector-specific regulatory requirements.[CISA, Post-Quantum Cryptography Initiative]

What This Roadmap Looks Like to an OCR Auditor

If OCR audits your organization in 2027 under a finalized Security Rule and asks about quantum risk management, this roadmap produces a clean evidentiary record: a written risk analysis that identified quantum threats as a documented risk category before any mandate required it; a cryptographic asset inventory completed in conjunction with the mandatory technology asset inventory; vendor questionnaires demonstrating due diligence on business associate cryptographic standards; updated BAA language negotiated during 2025–2026 renewal cycles; and a board-approved migration timeline with documented resource allocation. That record does not require perfection. It requires evidence of a systematic, good-faith risk management process — which is precisely the standard HIPAA has always used to evaluate compliance decisions.

Key Takeaways

  • The proposed HIPAA Security Rule overhaul targets May 2026 finalization and converts ePHI encryption from an "addressable" specification to a mandatory requirement — creating a natural integration point for PQC readiness planning that compliance officers should be using now.
  • No HHS or OCR guidance currently mandates post-quantum cryptography for HIPAA compliance. This absence is not permission to defer — it is a documentation liability, because HIPAA's "reasonable and appropriate" risk analysis standard applies to all known threats, including quantum.
  • NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) in August 2024. These are the reference standards compliance officers should use to frame vendor questionnaires and BAA modernization language.
  • Healthcare ePHI — with retention windows of 6–21 years — is a priority "harvest now, decrypt later" target. Adversaries do not need a quantum computer to begin the attack; they need only the storage capacity to archive encrypted data today.
  • Current BAA templates contain zero PQC language. BAA renewal cycles in 2025–2026 represent a time-bounded opportunity to introduce cryptographic modernization representations before a mandate forces a reactive, less-favorable negotiating position.
  • A phased compliance roadmap — inventory and assessment now, planning and vendor engagement through Q2 2026, implementation post-finalization — produces auditable documentation that positions organizations favorably under both the current Security Rule and any future quantum-specific guidance.
  • Compliance officers should treat the HIPAA Security Rule transition as a forcing function to build cryptographic agility infrastructure: inventories, governance structures, and vendor relationships that will serve the organization across multiple future cryptographic transitions.

This article draws on primary documentation from the HHS Office for Civil Rights HIPAA Security Rule resources, the 2024 Federal Register NPRM for the HIPAA Security Rule (Docket HHS-OCR-0945-AA20), the 42 CFR Part 2 Final Rule, NIST FIPS 203, FIPS 204, and FIPS 205 (all finalized August 2024), NIST NCCoE SP 1800-38, and the CISA Post-Quantum Cryptography Initiative. All claims verified against official sources as of March 2026. The article accurately represents the regulatory gap: no primary HHS or OCR source currently links PQC standards to HIPAA compliance obligations.

Disclaimer: This content is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Consult a qualified professional before making compliance decisions. pqcinformation.com is independent and not affiliated with any vendor or standards body.

Read next