The Harvest-Now Liability
Key Takeaways
The breach that hurts you may already have happened. Attackers are stealing encrypted data now to "harvest now, decrypt later" or HNDL, once quantum computers can break today's encryption. Clinician credentialing files are close to the ideal target because nothing in them expires.
The deadline is already on paper. NIST plans to deprecate today's public-key encryption in 2030 and disallow it in 2035. A June 2026 White House memo tells federal agencies to cut as much quantum risk as feasible by December 31, 2030.
It will reach staffing firms through contracts, not regulators. The same memo tells agencies to write post-quantum readiness into vendor requirements. CMS will pass it down to health systems, who will pass that down through the MSP and VMS layer to every supplier.
This is a leadership question before it is an IT project. Most mid-market staffing firms cannot yet say where their encryption lives or which vendors control it. The executive who owns that answer matters more than the tool that finds it.
The first step is small. Inventory where clinician credential data lives and get each vendor's post-quantum roadmap in writing. That work can start this quarter without a consultant.
A phishing email landed in my inbox recently that looked exactly like the MyChart notices my doctor's office sends, down to the log-in prompt. It was the first time I had seen healthcare itself used as the way in, and it was convincing because the attacker understood that health data is the most trusted, and most valuable, information most of us have.
That email was an old kind of attack. The newer threat is quieter, and healthcare staffing firms are unusually exposed to it.
The File That Does Not Expire
Nearly every secure connection a staffing firm relies on, from the ATS log-in to the VMS integration to the payroll feed, is protected by public-key encryption such as RSA and elliptic curve cryptography. That math holds up against today's computers. However, it is not expected to hold up against rapidly developing quantum computers, and the industry's estimate of when that machine arrives keeps moving closer.
The risk does not start on the day those computers become readily available. It starts now. Attackers can take encrypted data today, store it, and wait. Google's security team put it plainly in a March 2026 post setting its own migration deadline: "The threat to encryption is relevant today with store-now-decrypt-later attacks."
We are calling this The Harvest-Now Liability: data stolen in encrypted form this year that becomes readable in 2030 or later, long after the breach notification letters have gone out and the incident has been closed.
Most stolen data loses value over time. Card numbers are reissued. Passwords are reset. Now look at what sits in a travel nurse's or locum tenens physician's credential file: a Social Security number, license numbers, background check results, a drug screen, immunization and TB records, I-9 documents, and often a passport scan. None of it expires. A file taken from your systems in 2026 is just as useful to a fraudster in 2031.
Staffing firms are already a target. A ransomware attack on an independently owned Manpower franchise in Lansing, Michigan, exposed data on 144,189 people, including passport scans and Social Security numbers. A healthcare staffing firm holds that same category of data, plus clinical credentials and health records, for every clinician it has ever onboarded.
The Deadline Is Already Set
For most executives, quantum computing still sounds like a 2035 problem. The published timelines say otherwise.
NIST's draft transition plan, IR 8547, deprecates today's vulnerable public-key algorithms in 2030 and disallows them in 2035. On June 24, 2026, the Office of Management and Budget issued memorandum M-26-15, which directs federal agencies to mitigate as much quantum risk as feasible by December 31, 2030, and to prioritize systems holding data "expected to remain mission-sensitive in 2030." Based on their own quantum research experience, Google has set 2029 for its own migration.
People who lived through Y2K will recognize the pattern. In 1997 the date felt distant. By 1999 it was a crisis, mostly because organizations had underestimated how long it would take simply to find the problem. Jim St. Clair, CEO at MyLigo, who works with security leaders in both the healthcare and government sectors on post-quantum readiness, framed it this way in a recent conversation: "You can't build a football stadium in 12 months. If you don't know what you don't know about your environment, then how long do you think it takes in order to figure it out?" For a large health system, a scoped discovery engagement runs about 12 weeks, and that covers only finding the problem. Fixing it can take anywhere from a month to three years, depending on who controls the code. Those figures describe large systems with sprawling environments. A staffing firm has a much smaller footprint, which is good news, but the lesson is the same: the lead time is long, so the start date matters more than the size of the firm.
There is one important difference from Y2K. January 1, 2000, was fixed on the calendar. The quantum date is an estimate, and a single breakthrough could move it earlier.
How It Will Reach Your Desk
No regulator is going to send a healthcare staffing firm a post-quantum mandate next year. It will arrive through the client contract, which is how security requirements usually reach this sector.
M-26-15 assigns agency leaders the job of making sure "vendor requirements include PQC-readiness and cryptographic agility provisions." It is hard to imagine CMS holding itself to that standard without expecting the same from the contractors and data centers that exchange Medicare transactions with it. Health systems will fold the same language into their own security reviews. From there it moves down the chain: the health system asks the MSP, the MSP asks the VMS, and the VMS asks every supplier on the program.
In practice, it will show up as a new line on the annual vendor security questionnaire and as a new piece of evidence your auditor asks for under the encryption controls in your SOC 2 report. Having "encrypted in transit" will no longer be enough. You will be asked which encryption, and when it will be replaced.
The HIPAA Security Rule overhaul proposed by HHS points the same direction. It would require a current inventory of every technology asset that touches protected health information (PHI). It is not final yet, and HHS is now targeting July 2027, but it shows where health system security reviews are heading.
Health systems have good reason to look hard at their vendors. The biggest healthcare breach disclosed in 2025, affecting more than 62 million people, happened at a business services vendor, Conduent, not at a hospital.
Your Vendors Hold the Keys
Hospitals are discovering that much of their exposure sits inside medical devices they cannot patch themselves. An infusion pump manufacturer may need 18 months, or a new chipset, before it can do anything. Staffing firms have the same problem in a different form. Your encryption lives inside the ATS, the VMS integrations, the credentialing platform, the background screening vendor, the payroll and benefits systems, and the e-signature tool. You own the data. You do not control most of the code protecting it.
A medical device executive in the same conversation made a point that applies directly to staffing technology. Devices sold today are supported for seven to ten years, so a product shipped this year will still be in service after 2031. The same is true of a five-year ATS or VMS contract signed this quarter. If post-quantum readiness is not written into that agreement now, you will be negotiating it later with far less leverage.
Not every system needs the same urgency. The sensible approach is risk-based: identify which systems hold long-lived candidate and clinician data, which vendors control their encryption, and which of those systems you plan to replace before 2030 anyway. Some systems can wait. Some can be walled off behind newer, quantum-resistant network controls while the vendor catches up. But none of those decisions is possible without the inventory.
The First Step Is Small
Nothing above means a 40-person staffing firm needs a multi-year program. The long timelines belong to large health systems with vendor-controlled code and thousands of connected systems. For most staffing firms, the lead time is long, and although the first step is small, it should start now.
That first step has two parts. First, build an inventory of where clinician credential data lives: the ATS, the credentialing platform, the background screening vendor, payroll, and the e-signature tool. Second, ask each of those vendors for its post-quantum roadmap, in writing. Neither task requires a consultant or a budget line. Together they produce the one document that every client security review, auditor, and future buyer will eventually ask you to show.
Jim St. Clair's advice for smaller organizations is direct: "Recognizing most small practices are dependent on their vendors for support, make a prioritized list of your systems as [you] begin calling. Find out if they've got a migration plan, or even heard of PQC. Be prepared to start finding vendors that can offer real plans, not just assurances."
Whose Problem Is This?
The most useful line in M-26-15 is not technical. It says the migration "is not only the responsibility of the agency-level Chief Information Officer (CIO) and Chief Information Security Officer (CISO)," and that success "requires accountability and responsibility for each member of an agency's leadership teams." The CFO is given a named role in funding it.
That framing fits healthcare staffing well. Many mid-market firms do not have a dedicated CISO. Security usually sits with a CIO or CTO who is also running the VMS integrations, the AI pilots, and the next platform migration. Post-quantum readiness lands on top of all of it, with a deadline that is real but moving, and a vendor dependency the firm does not control.
We expect the question to surface in M&A diligence before it surfaces in most client contracts. A buyer underwriting a five-to-seven-year hold is underwriting through 2031. Sooner or later, someone on the buyer's side will ask whether the target can produce a cryptographic inventory, and a blank look will be treated as a finding.
Five questions are worth putting on the next executive team or board agenda:
Which of our systems hold candidate and clinician data that will still be sensitive in 2031?
Which vendors control the encryption on those systems, and what have they committed to in writing?
Which technology contracts up for renewal in the next 18 months run past 2030?
What systems are you buying TODAY that you expect to support for 5 or more years?
Who on the leadership team owns the answer, and do they have the time and budget to deliver it?
The fifth question is the one most firms will struggle with. The technology to find and fix vulnerable encryption exists, and NIST finalized the replacement algorithms in 2024. What most firms lack is an executive with the vendor-governance discipline to drive a multi-year migration across systems they do not own.
Morgan Taylor Executive Search places CIO, CTO, and security leaders exclusively in healthcare staffing. We assess candidates for the capability this migration demands, including vendor governance, risk-based prioritization, and board-level communication, using PhD-led I-O Psychology methods rather than gut instinct. Our median time-to-fill is 57 days, with candidates presented within 14 days. If your technology leadership bench is not built for a 2030 deadline, we should talk.
