A health system’s post-quantum cryptography (PQC) migration includes patient data, medical devices, and clinical systems, and different teams usually own each one. Patient records must be retained for 10 to 30 years, depending on jurisdiction, and kept confidential for as long as they are held. Infusion pumps, monitors, and imaging workstations often contain keys burned in at manufacture, and their software is patched slowly, if at all. In this workshop, you build one migration program across all three.

A device measurement published in June 2026 found PQC-capable SSH on 50% of IT devices inside enterprise networks, but on 6% of medical devices. Forescout Data: PQC Adoption Growing Fast, but 90% of Systems Still Exposed reports the figures, which describe device capability in the measured population, not migration progress. Operating system and browser updates are bringing PQC to enterprise IT, but they do not reach most clinical devices. Quantum Computing in Healthcare: A Field Guide for Health System Executives explains why a scanner purchase in 2027 is a cryptography decision.

We run this intensive as an eight-hour planning workshop, in one day in person or in two four-hour sessions live online. You work from your own data classes, device records, and vendor contracts, or from a sample health system we provide. No cryptography background is needed. You leave with a draft program plan and a year-one roadmap, with the assumptions you still need to check written down.

Who this intensive is for

Program managers and PMO leads, the CISO or CIO who will sponsor the program, security architects, biomedical and clinical engineering leads, and EHR, imaging, and laboratory system owners. Privacy, compliance, procurement, and vendor management staff belong in the room too. We recommend sending a mixed group from one health system, ideally the people who would be members of its quantum readiness steering committee. Securing the network, maintaining medical devices, and running the EHR are usually three different jobs.

Bring at least one person from clinical or biomedical engineering. Many of the sequencing decisions in this workshop are device decisions.

The intensive is for hospitals and health systems. Medical device manufacturers are welcome too, and leave with a clear view of what their customers are about to ask for. Pharmaceutical and biotech teams have their own course, the Quantum-Safe Pharma Intensive, built around GxP validation, record retention, and supply chain verification. To work through confidential detail with only your own colleagues present, book the intensive as private team training through training@quantumacademy.com.

What you’ll be able to do afterward

• Make the case that a health system’s PQC migration is a multi-year program across data, devices, and clinical systems
• Draft a program charter and business case, and define the steering committee that will govern the program
• Plan a cryptographic inventory in risk order, starting from records you already keep
• Set confidentiality horizons for patient data, score and tier your estate, and decide what happens to each device family
• Classify EHR vendors and device manufacturers by their effect on your timeline, question them in the right order, and grade every date they give you
• Apply the HIPAA Security Rule and FDA premarket cybersecurity expectations to your plan, without overstating what either currently requires
• Structure the program into workstreams and a year-one plan, with procurement requirements and KPIs your board can read

What you leave with

Every participant receives the course handbook, a PDF of every slide with notes that explain it in full. Each participant also receives a PDF copy of Quantum Ready, the companion book to the framework the day draws on. During the day, you build first versions of these working documents:

• An estate map of patient data, medical devices, and clinical systems, showing who controls each part
• A program charter and steering committee structure
• An inventory plan, with its three inventories, starting records, and order
• An initial priority list, with confidentiality horizons, device dispositions, and evidence gaps recorded
• A vendor dependency register that separates evidenced dates from assumptions, and draft contract requirements
• An external dependency map for regulators, manufacturer release dates, and partners
• A workstream structure with role and resource assumptions
• A year-one plan by quarter, with board KPIs and the decisions you need from others

The working documents are editable and yours to keep.

Preparing for the day

You can work through the day with data from your own organization or with a sample health system we provide. If you bring approximate figures from your own estate, you apply each module directly to your systems and devices, and the documents you leave with contain your own numbers. If you cannot share your data or have not had time to collect it, you work with the sample health system’s illustrative figures. You then apply the same templates to your own estate when you return to work.

Your joining instructions, sent seven days before the course, list what to gather if you want to use your own data. Approximate figures are enough:

• Your main clinical systems, such as the EHR and imaging, and who supplies each
• Your connected medical devices by type and manufacturer, with replacement dates where known
• Your data classification scheme and records retention schedule
• Contract renewal dates for your main software vendors and device manufacturers
• Any regulatory or insurer deadlines your organization already tracks

You decide what you share with the room. If you cannot take system or device documentation off site, bring a simplified version.

The day

The day draws on the lifecycle of the Applied Quantum PQC Migration Framework. The instructors also use its OT & Critical Infrastructure Extension for devices that cannot accept new cryptography in the field. The instructor starts each module with a short briefing. You then apply the module’s template to your own estate or to the sample health system.

In person, we teach the intensive from 09:00 to 17:00 local time, with lunch and two breaks:

• 09:00–09:50 · Module 1. Three estates and their owners
• 09:50–10:40 · Module 2. Mandate, governance, and the business case
• 10:40–11:00 · Break
• 11:00–11:45 · Module 3. Inventory planning
• 11:45–12:30 · Module 4. Risk scoring, priorities, and device triage
• 12:30–13:30 · Lunch
• 13:30–14:20 · Module 5. Vendors and device manufacturers
• 14:20–15:10 · Module 6. Regulators, release dates, and partners
• 15:10–15:30 · Break
• 15:30–16:15 · Module 7. Program structure and staffing
• 16:15–17:00 · Module 8. Year-one plan, KPIs, and the asks

Live online, we teach it in two four-hour sessions on consecutive days, each with a short break. We cover Modules 1 to 4 in the first session and Modules 5 to 8 in the second.

Module 1. Three estates and their owners

The instructor walks through the device measurement, to show why clinical technology will not migrate on enterprise IT’s update cycle. You then map your estate by domain and mark whether your teams, a software vendor, or a device manufacturer controls each part. You also list the parts nobody owns yet, such as pharmacy automation or laboratory middleware.

Module 2. Mandate, governance, and the business case

You draft a charter that commits to two outcomes, meeting your dated obligations and being able to change cryptography on the systems you control. You define the steering committee, with clinical engineering, EHR owners, privacy, and procurement alongside security, and one accountable executive reporting to the board’s risk committee. You build the business case from record lifetimes and device replacement cycles, with planned refresh shown separately from new money.

Module 3. Inventory planning

You plan three linked inventories, covering patient data by class, systems and devices, and the cryptography that protects them. You start with the internet-exposed systems whose data must stay confidential past 2035, such as genomics, behavioral health, and oncology, and with long-lived trust anchors. You find devices through procurement records and device bills of materials, then add third-party connections. You tag every entry by who can change it.

Module 4. Risk scoring, priorities, and device triage

You set a confidentiality horizon for each class of patient data. Harvest Now, Decrypt Later: Which Data Is Actually at Risk explains why genetic and clinical records stay sensitive for decades. You score the estate on exposure, trust-infrastructure criticality, migration feasibility, and regulatory pressure, record unknowns instead of guessing them, and tier each fully scored entry. For each device family, you record whether its manufacturer will migrate it, or whether you will protect it behind a gateway, isolate it, or retire it.

Module 5. Vendors and device manufacturers

You classify suppliers by how much of your timeline they control, from EHR and laboratory system vendors to device manufacturers. You open every conversation with the same two questions about crypto-agility, and grade every date as committed, forecast, announced, or unknown. You draft requirements for the next device purchase and EHR renewal. Vendors that keep health records for you also get the inventory and dependency questions set out in Getting Vendors to Answer the Right Questions.

Module 6. Regulators, release dates, and partners

You record each device fix as a dependency on the manufacturer’s release date, including any regulatory review the change may trigger. The instructor walks through what the HIPAA Security Rule requires today, the January 2025 proposal to update it, and FDA premarket cybersecurity expectations for new devices. What Actually Binds You in the US Post-Quantum Rulebook lists the evidence a hospital network should keep even where nothing is mandatory. You treat a connected partner’s date as unknown until the partner puts it in writing.

Module 7. Program structure and staffing

You break the work into workstreams and repeatable work packages, such as one approved pattern applied to one device family or one clinical application. You set the gates and the staffing, and the evidence each wave needs, such as a tested rollback and an agreed clinical availability window. You also agree what the steering committee does when a manufacturer or vendor misses a committed date.

Module 8. Year-one plan, KPIs, and the asks

You assemble the day’s work into a year-one plan by quarter, from naming the accountable executive to changing procurement language. You add board KPIs for coverage, trust anchors, inventory, vendor commitments, and agility. You list the decisions you need from executives, the board, device manufacturers, and vendors, and the instructor reviews each plan before the session ends.

Common questions

How technical is the day?

The day is about planning and program management. You need a working knowledge of your own systems and devices, and no background in cryptography. The instructors explain the technical background to each decision in the module that needs it.

Do we need a cryptographic inventory before the day?

No. In Module 3, you plan the inventory from records you already keep. Teams that already have an inventory or a cryptographic bill of materials (CBOM) bring it and use it in Module 4.

Can one person attend alone?

Yes. You complete the same templates and note the questions that need a colleague. A mixed group from one health system can answer more of those questions in the room.

Is the intensive vendor-neutral?

Yes. We favor no EHR vendor, device manufacturer, or cloud provider, and we judge algorithms and products against published standards and public evidence.

Where this course fits

We recommend Quantum-Safe Healthcare as preparation, though you can enroll without it. It covers the same ground at overview depth. Participants who have taken it already know the terms we use during the day. Afterward, whoever will run the program can take PQC Migration Project Management, and whoever leads the device and supplier conversations can take PQC Vendor Governance and Supply Chain. Teams about to find the cryptography in their estate can take Cryptographic Discovery, Inventory, and CBOM.

Why we teach this

This intensive is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org. No healthcare extension of the framework has been published yet. The course author wrote the framework. The instructors run migration programs in this industry and teach the sector material from that field work.

Certificate of Completion

Upon completion, you receive a Quantum Academy certificate of completion. It confirms that you completed the course and is separate from Quantum Academy’s professional certifications.

Enrollment includes 180 days of access to the corresponding online on-demand course. Where that course is not yet published, the 180 days start on the day it is.

About this program

Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.

Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.