From HIPAA compliance to quantum computing: how artificial intelligence, blockchain and next-generation computing are changing the security of patient data.
HIPAA: the floor, not the ceiling
The Health Insurance Portability and Accountability Act of 1996 set the framework for protecting patient health information in the United States. Its Security Rule requires covered entities and their business associates to put administrative, physical and technical safeguards around electronic protected health information (ePHI).
Three rules do the work: the Privacy Rule, the Security Rule and the Breach Notification Rule. Civil penalties are tiered by how much an organization knew and what it did about it, and serious cases can bring criminal charges. See HHS enforcement for the current tiers. Many security experts argue the law’s technical requirements move more slowly than the threats do.
- Administrative safeguards. Workforce training, access management policies, contingency planning and a designated security officer.
- Technical safeguards. Access controls, audit controls, integrity controls and transmission security.
- Physical safeguards. Facility access controls, workstation use policies, and device and media controls.
- Breach notification. Affected individuals must be notified without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people also go to HHS within 60 days; smaller ones are reported to HHS each year. See the Breach Notification Rule.
AI as both shield and attack vector
On defense, AI-driven security tools analyze network traffic at a scale no human team can match, flagging behavior that points to ransomware staging, insider threats or advanced persistent threats as it happens.
Machine learning models trained on past intrusions can isolate a suspicious endpoint before a breach spreads. Natural language processing can redact PHI from clinical notes before they reach analytics pipelines. Behavior-based identity tools, using signals like typing rhythm and login patterns, can keep authenticating clinicians in the background without interrupting their work.
Attackers use the same technology. Generative models write convincing phishing emails aimed at healthcare executives, synthesize voice calls that impersonate a CFO, and automate the search for vulnerabilities across hospital networks.
Regulation is following. The FDA’s framework for AI-enabled medical devices and HHS guidance on AI in clinical decision support add obligations on top of HIPAA: security has to protect the data and also the integrity and explainability of AI systems that touch patient care. More on how AI is changing healthcare communication.
Blockchain: tamper-evident audit trails for health data
Blockchain’s core properties, decentralization, immutability and cryptographic verification, map onto some of healthcare’s persistent problems: fragmented records, unauthorized changes to data, and opaque consent management.
Recording access logs and consent as signed transactions on a distributed ledger creates a tamper-evident audit trail that supports HIPAA’s audit control requirements and makes after-the-fact changes detectable. Permissioned networks such as Hyperledger Fabric let healthcare consortia share records while enforcing access policies in the protocol itself.
- Identity verification. Self-sovereign identity frameworks let patients hold their own health credentials, removing the central identity stores that attract attackers.
- Drug supply chain. Blockchain has been piloted for traceability under the FDA’s Drug Supply Chain Security Act, to help stop counterfeit drugs reaching patients.
- Smart contracts and consent. Data sharing agreements written as code release access only when the agreed consent conditions are met, which reduces human error in disclosure.
- Limitations. Storing raw PHI on a chain conflicts with patients’ rights to access and amend their records. Most designs keep PHI off-chain and store only hashes and pointers.
Quantum computing: plan for it now
Quantum computing is a long-term threat to the encryption that protects most healthcare data in transit and at rest. RSA-2048 and elliptic curve cryptography are both vulnerable, in theory, to Shor’s algorithm on a large enough error-corrected quantum computer.
The timeline is debated, but government security agencies treat the threat as credible. The immediate risk is “harvest now, decrypt later”: adversaries can store encrypted data today and decrypt it once the capability exists. Medical records stay sensitive for decades, so healthcare is exposed.
In 2024 NIST finalized its first post-quantum cryptography standards, based on CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures. Healthcare organizations can start planning for cryptographic agility now.
Quantum technology also helps defenders. Quantum key distribution uses physics to protect key exchange, and quantum random number generators improve the randomness behind encryption keys. Expect hybrid classical-quantum security through the transition.
Near term (now to 2027)
Inventory your cryptographic assets. Identify systems that use RSA or ECC. Pilot NIST post-quantum algorithms in non-critical systems.
Medium term (2027 to 2032)
Move high-risk ePHI systems to hybrid or full post-quantum encryption. Add quantum-readiness requirements to vendor contracts.
AI, blockchain and quantum computing together make healthcare security more complex. The everyday exposure still sits in how teams share patient information. See the top security risks in healthcare communication.
Secure communication with Buzz
Buzz from Skyscape gives care teams one HIPAA-compliant place for messaging, calls, video visits and shared files. Data is encrypted in transit and at rest, Skyscape signs a BAA, and Skyscape holds a SOC 2 Type 2 attestation covering the Security trust services criteria. The Buzz FAQ answers the common questions.