Medical records protected for decades — from DICOM to telehealth APIs
Medical records today (imaging, genomics, ECG) must be retained 25-99 years. If encrypted with RSA or ECDSA today, an attacker can capture and decrypt them once a sufficiently large quantum computer exists. The patient is born today, the attack happens in 2035+. The only defense is migrating to post-quantum cryptography before Q-Day.
Three real scenarios where PosQuantum acts
Long-retention DICOM archive
University hospital with ~4 PB of DICOM images (X-ray, CT, MRI) accumulated over 12 years. Requirement: minimum 25-year retention for pediatrics, 5 years for adults, and immediate clinician access.
Traditional storage encrypted with AES-256 + key wrapped by RSA-2048. Q-Day breaks RSA and exposes symmetric keys.
PUCE Archive creates signed manifests (Ed25519 today, Dilithium3 migration on SDK upgrade) pointing to blobs already in R2. Lossless compression applied before upload (typical 18-42% savings on DICOM). Periodic automatic verification guarantees integrity. Keys wrapped with ML-KEM-1024 via PQSL.
Cross-border telemedicine (EU + Switzerland)
Video-consultation SaaS platform. 40k physicians, 2M patients, data subject to GDPR (EU) and nLPD (CH). Peaks of 8k concurrent sessions.
Current TLS 1.3 uses ECDHE-X25519 for handshake — breakable by a quantum computer. Audio/video stream can be harvested by state MITM and decrypted retrospectively.
PUCE Stream with PQSL-encrypted segments (ML-KEM-768 hybrid X25519+Kyber handshake). PQSL middleware in front of Express API maintains rate-limit + PQC headers. Consultation records go to PUCE Archive (7-year legal retention).
Secure genomics sharing for research
Consortium of 6 European hospitals sharing WGS/WES datasets (3-10 GB per patient) for cancer studies. Pseudonymised but still re-identifiable data.
SFTP sharing with classical SSH keys. Files in cold cloud storage encrypted with AES-GCM and RSA-wrapped master key.
PUCE Storage as collection layer (short-TTL presigned URLs). PUCE Archive per study with signed file list, allowing "patient in study" audit. Per-researcher access tokens derived via ML-KEM — each researcher has a short rotatable key.
Reference architecture
1. Ingestion
DICOM / HL7 FHIR modality sends via PQSL middleware (Express/FastAPI/Spring) to presigned upload endpoint.
2. Storage
PUCE Storage stores blobs on R2/S3 encrypted with AES-256-GCM, key wrapped by ML-KEM-1024.
3. Legal archive
PUCE Archive creates signed manifests by retention policy (25 years pediatric, 5 years adult), offline-verifiable.
4. Clinical access
PUCE Stream for in-browser DICOM viewing without full download; 1-7 day TTL tokens.
5. Audit
Immutable SHA3-256-signed logs + SLAAC for HIPAA/ISO 27799 inspection.
Applicable PosQuantum products
Regulatory compliance covered
Need to protect medical records for 25+ years?
Talk to our team — we design the PQC migration without halting clinical operations. PoC in 2 weeks, pilot in 60 days.