James Maitland is a visionary in the integration of robotics and IoT within medical ecosystems, possessing a deep understanding of how connected devices pulse at the heart of modern patient care. With a background that bridges the gap between hardware innovation and digital risk management, he has spent years advocating for the “security-by-design” philosophy in clinical environments. His expertise offers a unique vantage point on the looming shadow of quantum computing—a technology that promises to revolutionize science while simultaneously threatening to dismantle the encryption protocols that keep patient lives and data safe.
The conversation explores the stark disparity in quantum readiness between traditional IT and specialized medical hardware, the insidious “harvest now, decrypt later” tactics employed by global cyber adversaries, and the immense financial and regulatory pressures facing healthcare leaders as they navigate this complex transition. We delve into the critical need for adopting post-quantum cryptography standards to protect a sector that is increasingly under fire from ransomware and data breaches.
With traditional IT systems reaching a 50% readiness rate for quantum-resistant encryption, why are medical devices like infusion pumps and patient monitors lagging so drastically behind at just 6%?
The discrepancy is truly alarming when you consider that these devices are the ones physically tethered to patients in their most vulnerable moments. In our research analyzing more than 2.5 million devices across 50 healthcare organizations, we found that traditional IT—the servers and workstations—is much easier to patch and rotate than specialized medical hardware. Infusion pumps and monitors are often built on legacy architectures that were never designed for the heavy computational load of post-quantum cryptography. These devices are the workhorses of the hospital floor, but they are notoriously difficult to update because a simple reboot or software flash can have life-or-death implications if not handled with extreme care. This creates a dangerous “readiness gap” where the infrastructure is evolving, but the actual tools of care remain trapped in a pre-quantum security era.
When we look at the specific types of data being handled, why do electronic medical records and diagnostic images represent such a unique and critical vulnerability in the face of quantum decryption?
Unlike a stolen credit card number that can be canceled or a password that can be changed in seconds, your medical history is immutable and carries a heavy emotional weight. Electronic medical records, lab results, and diagnostic images are essentially digital reflections of our physical selves, and they remain sensitive for decades. If a quantum computer can eventually unscramble a patient’s genetic profile or history of chronic illness, that information can be used for insurance fraud, blackmail, or targeted social engineering for the rest of that person’s life. There is a certain chilling permanence to healthcare data that makes it the ultimate prize for attackers. We have to view these records not just as files, but as lifelong assets that require a level of protection capable of outlasting the current cryptographic standards.
How should healthcare executives interpret the “harvest now, decrypt later” strategy, and what does this mean for the immediate security of information that is currently being stolen?
This is perhaps the most ominous trend we are seeing because it shifts the threat from a hypothetical future to a present-day crisis. Adversaries are currently acting like digital squirrels, hoarding massive amounts of encrypted healthcare data in vast storage arrays, waiting for the day—perhaps only a few years from now—when quantum processors are powerful enough to crack it. Even if we implement perfect security starting today, the data that walked out the door yesterday is already at risk of being exposed in the near future. The sense of urgency is compounded by the fact that cyberattacks are already rampant; we tracked 461 public ransomware claims against healthcare providers globally in a single eight-month period, which is a 47% increase compared to previous cycles. This tells us that the “harvest” is already in full swing, and organizations are losing their most valuable data at an accelerating pace.
Given that the average cost of a healthcare breach has hit $6.64 million, how can organizations justify the significant current expense of quantum-proofing their systems?
The financial math is brutal, but it actually favors early adoption when you look at the long-term survival of the institution. A CEO or CFO isn’t just choosing whether to spend money today; they are choosing between a planned, multi-year modernization cycle or a catastrophic, emergency catch-up effort that will cost ten times as much after a breach occurs. When a breach hits, that $6.64 million price tag covers the immediate fallout—the forensic teams, the legal fees, and the victim notification—but it doesn’t account for the shattered trust of the community or the disruption to patient services. By incorporating quantum readiness into existing procurement and technology refresh cycles, hospitals can spread the cost over time. Transitioning the 66% of connected devices that are traditional IT is a great start, but we cannot ignore the medical devices that could become the ultimate “backdoor” for attackers.
With the National Institute of Standards and Technology having released its first set of post-quantum cryptography standards back in 2024, what are the primary hurdles preventing the remaining 69% of internet-facing systems from adopting these protocols?
It often comes down to the complexity of the digital supply chain and the sheer inertia of legacy software. While it is encouraging that 31% of the 5,500 internet-facing systems we analyzed already support protocols capable of post-quantum cryptography, the remaining 69% are often tied to third-party vendors or older APIs that haven’t been updated. Many healthcare leaders are waiting for a clear regulatory mandate, wondering if these standards will be formally baked into existing cybersecurity obligations or if they will remain voluntary recommendations. There is also a technical hurdle: implementing these new algorithms requires a meticulous inventory of all assets, and many organizations simply don’t have a clear map of every patient portal or application programming interface they have exposed to the web. Without that visibility, you can’t protect what you don’t know you have.
What is your forecast for the future of medical device security as quantum technology moves from theory to reality?
Over the next few years, from 2026 to 2028, I expect we will see a massive “vulnerability shakeout” where healthcare providers are forced to decommission thousands of legacy devices that simply cannot support modern security standards. The pressure will come not just from the threat of quantum computers, but from insurance companies and regulators who will refuse to cover organizations that operate with a 6% readiness rate for their most critical assets. We will see the rise of “crypto-agility,” where medical devices are designed to swap out encryption algorithms as easily as they update their user interface, allowing them to stay ahead of the curve. Ultimately, the institutions that survive and thrive will be those that view cybersecurity not as a basement-level IT issue, but as a fundamental pillar of patient safety, just as important as sterile instruments or qualified surgeons. We are entering an era where the digital health of a hospital is inseparable from the physical health of the patients it serves.
