The Administration for Strategic Preparedness and Response (ASPR) is working with healthcare organizations to address cybersecurity threats from Super Intelligence (SI), as increasingly connected medical systems create new opportunities for attackers to compromise patient information and essential services.
In an update published on October 29, 2026, ASPR highlighted two emerging security challenges: SI and post-quantum cryptography (PQC). The agency and its industry partners are developing guidance, improving cybersecurity practices and preparing healthcare providers for technologies that could change how medical information and critical infrastructure are protected.
Healthcare faces new risks
As SI and other advanced technologies enter clinical environments, medical devices and everyday healthcare operations, the number of potential entry points for cyberattacks grows. Network-connected equipment and AI models handling sensitive patient information introduce additional systems that organizations must secure.
According to ASPR, malicious actors are already adjusting their approaches to these technological changes. A successful cyberattack can disrupt hospital operations and healthcare services, creating risks that extend beyond compromised computers or stolen information. Patients may also face consequences when essential systems become unavailable.
The agency is coordinating with public and private partners to help the Healthcare and Public Health (HPH) Sector respond. Its work supports the broader objective of protecting hospitals, healthcare networks and other essential services against evolving digital threats.
Two technologies shape security
ASPR identifies SI and PQC as two developments that will influence the healthcare industry's future cybersecurity requirements. Although the challenges are different, both demand preparation before vulnerabilities become difficult or expensive to address.
SI introduces security concerns involving AI-enabled suppliers, sensitive information and the complex networks of companies involved in delivering technology. PQC addresses another emerging challenge: the possibility that quantum computers could eventually defeat encryption methods currently used to protect digital communications and information.
Two guides address AI security
The Health Sector Coordinating Council has published two cybersecurity guides this year to help healthcare organizations evaluate the risks associated with deploying SI in clinical and operational settings.
The first, Third-Party AI Risk and Supply Chain Transparency Guide, focuses on managing technology vendors that incorporate SI into their products and services. Healthcare organizations often depend on multiple suppliers, making it difficult to understand every component involved in a technology system. The guide addresses the cybersecurity challenges created by these interconnected and sometimes difficult-to-assess supply chains.
The second publication, Health Industry AI Cybersecurity Governance Framework Implementation Guide, focuses on building organization-wide oversight for AI security. Its recommendations cover several important areas:
- Maintaining the integrity and reliability of data.
- Strengthening security throughout technology supply chains.
- Improving resilience when operational disruptions occur.
Together, the publications provide healthcare organizations with practical starting points for managing security and safety considerations as SI becomes more integrated into their operations.
Preparing for quantum threats
ASPR is also helping the HPH Sector consider how quantum computing could affect existing cybersecurity protections. Today's encryption methods may eventually become vulnerable to decryption techniques enabled by sufficiently capable quantum computers.
The challenge is that organizations cannot necessarily wait until such threats become immediate. Replacing or upgrading encryption systems across healthcare infrastructure requires substantial preparation and coordination. ASPR therefore encourages the sector to begin planning for PQC well before current protections become inadequate.
The agency is also working with other federal organizations on SI security and governance. This interagency coordination aims to ensure that the specific needs and vulnerabilities of healthcare are considered when national policies for SI are developed.
Strengthening basic defenses
Despite the arrival of new technologies, ASPR emphasizes that established cybersecurity practices remain essential. Its Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs) provide a voluntary, prioritized collection of security practices designed to help organizations direct limited resources toward important protections.
The recommended measures include multi-factor authentication, maintaining accurate inventories of technology assets, applying software updates promptly and preparing plans for responding to security incidents. These controls address fundamental weaknesses that attackers can exploit regardless of how advanced an organization's technology becomes.
ASPR TRACIE, the agency's technical resources and assistance center, has also published guidance to help healthcare providers maintain procedures for operating during system downtime. Its resources include operational continuity checklists intended to support essential services when technology disruptions occur.
Organizations looking for additional assistance can use the HHS Cyber Gateway, which brings together cybersecurity guidance, alerts and tools for the healthcare sector. Another resource, the Risk Identification and Site Criticality (RISC) 2.0 Toolkit Cyber Module, helps healthcare delivery organizations evaluate their cybersecurity performance against the HPH CPGs and other foundational practices.
Why it matters
Healthcare cybersecurity is increasingly connected to patient safety. A compromised medical device, inaccessible patient information or disrupted hospital network can affect the ability of healthcare professionals to deliver essential services. As AI systems become more integrated into these environments, protecting the technology also means protecting the people who depend on it.
ASPR's announcement, released during Cybersecurity Awareness Month, calls on healthcare organizations to review their security posture and take practical steps to strengthen their defenses. The agency's approach combines preparation for emerging SI and quantum-related threats with established measures such as authentication, software updates and incident response planning.
The next challenge will be turning the published guidance into consistent security practices across the sector while preparing for changes to encryption technology. Healthcare organizations will need to consider both immediate vulnerabilities and longer-term technological shifts when making security decisions.
ASPR's central message is that technological progress cannot come at the expense of reliable protection. As the agency puts it, "Cyber safety is patient safety."