The challenges of moving to PQC in the US healthcare sector

At the AI Networking Summit on October 28,2026, an excellent session led by Kevin Chalker, CEO of Qrypt and Zak Pantelli, chair of H-ISAC, discussed  the roadblocks to healthcare moving forward to be quantum ready.

The US government has recently mandated that all government agencies and their contractors need to be quantum ready by December 31, 2030. Healthcare, arguably the industry with the most critical data to protect from quantum, is slower to act than other industries such as financial services. Healthcare data, such as patient records and pharma drug discovery information have a long shelf like and are essential to protect. While financial institutions have been working on quantum for the past seven years or so, it has not been a top priority in healthcare.

The typical owner of Post Quantum Cryptography (PQC) in the enterprise is the CISO, with engagement with other teams. However, CISOs are overwhelmed by increased demands (partially driven by AI) and limited budgets.

PQC is viewed as a long-term threat, as many people think that quantum is far in the future. However, recent developments (stable qubits, etc.) have made the goal post nearer, and furthermore, “Harvest Now Decrypt Later” attacks are already happening, with organizations being hacked without knowing it.

Some of the roadblocks:

• There is arguably misinformation from vendors. For example, cloud vendors claim to be quantum ready, giving a sense of security. However, a secure cloud environment does not mean the entire infrastructure is quantum ready.
• The immediacy of the threat is typically not understood at a C level or board level, therefore not given the right priority, nor the right budgets.
• There is confusion about the right approaches. There are broadly two approaches: PQC and Quantum Key Distribution (QKD), both with pros and cons, and lots of variability in approaches. Broadly, the US is aligned with PQC while QKD is favored in Europe. There are many nuances in these approaches, and some argue that given the latest ability of AI to detect vulnerability, the long-term durability of PQC is in question. This is a complex debate and beyond the scope of this writing. Suffice it to say that some organizations are waiting for the dust to clear to decide on a path forward.
• The IETF is still determining the right approach for tackling digital signatures
• The vendors’ timeline. For example, Microsoft will not be ready before 2029, therefore, its customers cannot be ready before then
• Limited market awareness. A large part of the market is still quantum unaware, some are quantum curious, and only a small segment is quantum aware

Some have argued for regulation as a way to move the market forward. Some in the industry seem to be welcoming of regulation.

In my opinion, the way forward is to bring awareness to the C suite and board levels. While quantum is a major threat, it also has significant value creation opportunities that are already beginning to emerge. Those who fail to embark on this journey will be left behind, or worse may allow their companies to subject to a quantum enabled attack. Quantum belongs in the board room.

‍