up:: Doing the Work MOC
PQC for NHS Trusts
An NHS trust reading American healthcare security material is reading about a different legal system. HIPAA does not apply, its technical safeguards do not apply, and the argument built on them does not transfer. What a trust has instead is an obligation phrased as appropriateness rather than as a control list, a nearer assurance deadline than most people realize, and a national post-quantum timeline that is unusually specific by international standards.
This note is general education about UK regulation and NHS assurance, not legal advice. Obligations under UK GDPR and the Data Protection Act are determined with your own DPO and counsel.
The short version:
- UK GDPR Article 32 names encryption explicitly, assessed against the state of the art and the risk. It names no algorithm, and “state of the art” moves.
- ⭐ The nearer date is yours: the CAF-aligned DSPT assessment, mandatory by 30 June 2026. It is outcome-based, which is precisely the regime a cryptographic inventory produces evidence for.
- ⭐ The NCSC has published dated milestones: 2028, 2031 and 2035. They are guidance aimed at government and critical national infrastructure rather than a trust obligation.
- Which means the dates that reach you arrive through suppliers, because your EPR vendor and cloud providers are selling into buyers who are inside those milestones.
- The patient-record shelf life is the one thing the jurisdiction does not change.
What actually binds a trust?
UK GDPR Article 32 requires “appropriate technical and organisational measures” and explicitly names “the pseudonymisation and encryption of personal data” among the measures to consider, judged against the state of the art, the costs, and the risk to individuals. ⚠️ “State of the art” is a moving reference, in the same family as the ones the US financial rules use, and it is the mechanism by which this obligation changes without anybody amending it.
The Data Security and Protection Toolkit is the operational instrument. Every organization with access to NHS patient data completes an annual DSPT self-assessment, and in September 2024 it changed for NHS trusts and foundation trusts, integrated care boards, commissioning support units and DHSC arm’s length bodies to a version aligned to the Cyber Assessment Framework. There is a mandatory deadline of 30 June 2026 for the CAF-aligned assessment.
Source: NHS England Digital, Data Security and Protection Toolkit and CAF-aligned DSPT guidance, digital.nhs.uk.
⭐ Why the CAF alignment matters for cryptography specifically. A checklist assessment asks whether a control exists. An outcome-based one asks what you know about your own estate, and that is a question a cryptographic inventory answers and nothing else does. The change from a toolkit to a CAF-aligned toolkit is therefore the single best internal argument for doing the inventory, and it has a date attached.
Where are the dated post-quantum milestones?
With the NCSC, and they are unusually specific:
| Milestone | What the NCSC asks for |
|---|---|
| By 2028 | Complete discovery and assessment, and produce an initial migration plan naming highest-priority activities, supplier and infrastructure dependencies, and the investment required |
| By 2031 | Complete the highest-priority migration activities, ready the infrastructure, and refine the plan into a clear route to full migration |
| By 2035 | Migration complete for all systems, services and products |
Source: NCSC, “Timelines for migration to post-quantum cryptography,” ncsc.gov.uk.
⚠️ These are guidance, aimed principally at government and critical national infrastructure, and they are not a trust’s statutory deadline. Saying otherwise would be wrong and a supplier will correct you.
⭐ What they genuinely do is set the ecosystem’s clock. The vendors selling EPR platforms, imaging archives, network equipment and cloud services into UK public-sector buyers are working to 2028, 2031 and 2035. That is when their products change under you, which makes the NCSC timeline the most useful planning artifact a trust has even though it does not bind one.
Canada’s authority published nearly the same years independently, which is worth knowing as corroboration rather than as an obligation: see PQC for Canadian Health Systems.
Why does the shelf-life argument survive the jurisdiction change?
Because it is a fact about the data. A pediatric record created this year describes someone who will be alive in 2090, and the identifiers in it cannot be reissued. That is the profile the vulnerability test describes, and it reads identically in London and in Ohio.
What changes is the pressure, and it changes unhelpfully. A US covered entity at least has a named technical safeguard to point at, even a weak one. An appropriateness standard gives a trust more freedom and less external force to use it.
Where does the cryptography live in a trust?
| Surface | Typical zone | Note |
|---|---|---|
| The electronic patient record | Zone 2 | One vendor platform holding the longest-lived data in the organization |
| Medical devices and clinical equipment | Zone 3 | Decade-plus service lives, limited update paths. See PQC in Medical Devices |
| National and regional connections | Zone 2 | Spine services and shared care records, terms set centrally |
| PACS and diagnostic imaging archives | Zone 1 and 2 | ⭐ The largest at-rest estate, holding the oldest cryptography |
| Research partnerships and trials | Zone 2 and 3 | Patient data inside universities and sponsors |
| Estates and building management | Zone 3 | Rarely inventoried, on industrial lifecycles. See PQC for OT, ICS, and SCADA |
The research row is distinctive to teaching trusts: data leaves for legitimate purposes and the receiving institution’s cryptographic posture becomes yours in practice.
Common misconceptions
“We follow HIPAA-equivalent standards.” There is no equivalence to follow. HIPAA names a technical safeguard; UK GDPR names an outcome and a factor to weigh. Those produce different evidence.
“The NCSC dates are our deadlines.” They are guidance for government and CNI. Treat them as the supplier ecosystem’s schedule, which is the thing that will reach you.
“The DSPT is a form-filling exercise.” The CAF-aligned version is outcome-based, which is a different assessment with different evidence, and it has a 30 June 2026 deadline.
“Our EPR supplier will handle it.” On their timeline, and the contract is your only visibility into it.
Questions people ask
What is the first artifact to produce? A cryptographic inventory covering the EPR and the imaging archive. It is the evidence the CAF-aligned DSPT rewards and the input every supplier conversation needs, so it pays for itself twice.
Does the DSPT require anything specific about cryptography? It requires an outcome-based account of your security. Treat that as the reason to hold an inventory by June 2026 rather than as a cryptographic mandate, which it is not.
How do we ask a national platform provider about post-quantum? The same way as any supplier, and the answers are more likely to exist here, because those providers sit inside the government roadmaps carrying the 2031 and 2035 dates. The questions are in the vendor-claims checklist.
Is our position better or worse than a US hospital’s? Better on information, worse on pressure. You have dated national milestones to plan against and no rule compelling you to.
What about a research partnership? Treat the receiving institution as a supplier holding patient data, because that is exactly what it is.
Where does procurement fit? Everything above resolves into contract terms eventually. Procurement language is what turns a supplier’s answer into an obligation.
Everything here is the map, given freely. When a trust needs its estate inventoried against the supplier roadmaps that will actually move it, and that inventory shaped into CAF-aligned evidence, that’s the work I do.
Last verified 2026-09-07 · Updated 2026-09-07 · Maintained by Addie LaMarr, LaMarr Labs.