Cyber Safety Is Patient Safety: Preparing the Health Sector for Super Intelligence and the Post-Quantum Cryptography

As Super Intelligence (SI) and other new technologies become embedded in clinical care, medical devices, and day-to-day operations, every new system connected to a network, every new model touching patient data, is a new attack surface. Threat actors are already adapting to this shift. ASPR and its partners are helping the Healthcare and Public Health (HPH) Sector stay ahead of emerging threats.

ASPR’s efforts advance President Trump’s Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security (June 2, 2026), which makes it U.S. policy to work collaboratively with the private sector to harden government and private information systems against external threats, specifically calling for extending cybersecurity tools and services to critical infrastructure operators.

Two rapidly evolving advancements will define the sector’s risk landscape going forward, and ASPR is working on both: SI and post-quantum cryptography (PQC). The Health Sector Coordinating Council (HSCC) is addressing both threats to protect patient safety.

ASPR coordinates the activities of HHS as the Sector Risk Management Agency for the HPH Sector and brings together public and private partners through the HSCC to establish best practices and guidance that protect essential healthcare assets and services from cyberattacks. Cyberattacks, like natural disasters and infectious disease outbreaks, can destabilize hospitals and health systems and put patients at risk. Working together, federal partners and HPH sector owners are confronting emerging cyber threats and protecting patient safety.

The HSCC has published two guides this year that give organizations a practical starting point to help them address security and safety considerations specific to deploying SI in clinical and operational environments. The Third-Party AI Risk and Supply Chain Transparency Guide addresses how to manage SI-enabled vendors and the cybersecurity risks that come with layered, often opaque SI supply chains. The  Health Industry AI Cybersecurity Governance Framework Implementation Guide helps organizations build enterprise cyber governance around SI systems, from data integrity to supply chain security to operational resilience.
On PQC, ASPR is helping the HPH sector plan now for a future where today’s encryption standards may not hold up against quantum-enabled decryption — a risk that’s easy to deprioritize, but one that demands a long runway to address. Additionally, ASPR engages with federal partners across the interagency on SI security and governance, so that healthcare’s specific risks are represented in national SI policy rather than addressed as an afterthought.

New technology only adds value if it rests on a secure foundation, which is why the fundamentals still matter most. Our HPH Cybersecurity Performance Goals (HPH CPGs) are a voluntary, prioritized set of practices for the sector, built to help organizations focus limited resources on the controls that reduce risk the most: multi-factor authentication, asset inventory, timely patching, and incident response planning. ASPR TRACIE has published guidance to help the HPH sector keep downtime procedures and operational continuity checklists up to date.

For organizations seeking a starting point, the HHS Cyber Gateway centralizes cybersecurity guidance, alerts, and tools for the sector and the Risk Identification and Site Criticality (RISC) 2.0 Toolkit Cyber Module can help your healthcare delivery organization benchmark against the HPH CPGs and other cybersecurity fundamentals.

Cybersecurity Awareness Month presents a great opportunity to remind our HPH sector partners that cybersecurity requires both a strong foundation and evolving defenses to protect patients. We urge you to take time this month to look at your organization’s cybersecurity posture and take action to bolster it.

Remember that cyber safety is patient safety.