A medical record can matter to its subject long after the transaction that created it. That is the ethical concern we bring to NIST’s August 13, 2024 release of three post-quantum cryptography standards. The announcement includes medical records among the electronic information encryption protects and encourages administrators to begin incorporating the new standards into their systems. [nist]

The technical contribution has a defined scope. FIPS 203 specifies ML-KEM, which establishes a shared secret key that symmetric-key algorithms can then use for encryption or authentication. It does not directly encrypt a whole archive. The standard says its security depends on conditions including keeping secret values private, and warns that a conforming product cannot guarantee the security of an entire system. [fips203]

Our ethical interpretation is that accepting sensitive information creates a responsibility that should not be measured only by the convenience of collecting it. For records kept over long periods, asking how protection will be maintained is a stewardship question, not a prediction about when quantum attacks will become practical. This reasoning claims no religious consensus and does not turn a technical standard into a moral certificate. [nist][fips203]

There is also a constraint worth respecting: NIST says integration takes time. Our judgment is that institutions owe people honest accounts of work completed and work remaining, rather than assurances of permanent safety. The two documents do not establish what any hospital has deployed or how much it should spend. Both originate with NIST. They support this account of the August 13 standards, not an independent audit of anyone’s care for confidential records. [nist][fips203]

Source documents

  1. NIST Releases First 3 Finalized Post-Quantum Encryption Standards | NISThttps://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
  2. Module-Lattice-Based Key-Encapsulation Mechanism Standard (FIPS 203)https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.203.pdf