This workshop examines Harvest-Now-Decrypt-Later threats to long-retained patient and genomic data, for healthcare professionals and data stewards.
Patient health records are retained for decades. GP records in England are kept for 10 years after death. Mental health records, 20 years after last contact. Paediatric records, until the patient turns 25. Genomic data, indefinitely. And genomic data is categorically different from other health data on one dimension: it cannot be anonymised. A DNA sequence is the unique identifier of the individual. NHS Genomics England's National Genomic Research Library holds over 110,000 clinically linked whole genomes. 23andMe's 2023 breach exposed 6.9 million individuals' genetic data. An adversary who harvests encrypted genomic sequences today and decrypts them in 2035 has not compromised historical records. They have compromised individuals who will still be alive, will still have living relatives, and whose genetic information will still be relevant to insurance, employment, and law enforcement.
This workshop helps information governance and security teams map their data retention obligations against cryptographic exposure windows, with a dedicated module on genomic data as a permanently non-anonymisable data class. The session covers GDPR Article 9 special category data obligations as they intersect with quantum cryptographic risk, GDPR Article 32 and Recital 83 (state of the art in security), NIS2 cryptographic requirements for essential entities, the NHS DSPT trajectory, and how to communicate quantum data risk to hospital boards and Caldicott Guardians. Participants leave with a remediation priority matrix that ranks datasets by sensitivity, retention period, permanent identifiability, and current encryption strength.
Half-day session structure with a scheduled break. Content is configurable to your organisation's data classification requirements and governance structure.
| # | Session | Topics |
|---|---|---|
| 1 | HNDL in Practice Evidence of state-level data harvesting campaigns against healthcare | |
| 2 | Data Retention Mapping Exercise Your records, your exposure windows |
|
| Break, after 45 min | ||
| 3 | Genomic Data: Permanent Identifiability NHS Genomics England and the 23andMe precedent |
|
| 4 | Regulatory Landscape GDPR Articles 9 and 32, NIS2, ENISA June 2025 guideline, NHS DSPT |
|
| 5 | Remediation Priority Matrix and Board Briefing Building the case for information governance committees |
|
| 6 | Q&A and Action Planning | |
Workshops are designed and delivered by QSECDEF in collaboration with sector specialists. All facilitators have direct experience in both quantum technologies and healthcare systems.
Workshop design and delivery
QSECDEF brings world-leading expertise in post-quantum cryptography, quantum computing strategy, and defence-grade security assessment. Our advisory membership spans 600+ organisations and 1,200+ professionals working at the intersection of quantum technologies and critical infrastructure security.
Domain expertise and clinical validation
Healthcare-specific workshops are co-delivered with sector specialists who bring direct operational experience in NHS trusts, private hospital groups, pharmaceutical R&D, and medical device manufacturing. This ensures workshop content is grounded in regulatory, clinical, and operational realities.
Sessions are configured around your organisation's data classification requirements and governance structure. Get in touch to discuss requirements and schedule a date.
Contact Us