Quentir Medicine Monitor
Evidence-based insights for quantum medicine. Published by Quentir Systems LLC · November 10, 2026.
A regional hospital in southern Taiwan has placed a post-quantum TLS 1.3 gateway in front of its connections and tested it without touching its core hospital information system or its databases. The Kaohsiung Veterans General Hospital Tainan Branch presented that pilot on 6 November 2026, at a seminar on post-quantum migration for hospitals built around the FHIR standard for health data exchange.
The seminar was organized by the Institute for Information Industry (III) and the National Cheng Kung University Research and Development Foundation, under the guidance of the Administration for Digital Industries of Taiwan's Ministry of Digital Affairs. Their press release of 10 November 2026, distributed through the Central News Agency's business wire, calls the Tainan pilot the first post-quantum migration case in Taiwan carried out in a hospital during live operation. That description comes from the organizers; the release gives no technical report, algorithm list or test data behind it.
Wang Mei-chu, deputy director of the Department of Information Management at the Ministry of Health and Welfare, said the ministry will first plan and trial post-quantum protection for the healthcare professional certificates that doctors and nurses use to sign and authenticate, together with the security of cross-hospital data exchange. She also encouraged hospitals to use government program funds for small proof-of-concept projects.
For hospital buyers outside Taiwan, the useful part is the sequence. A health ministry has chosen where post-quantum work starts, one hospital has a working gateway pilot, and a medical center is testing encrypted transport on a shared care platform. Each step is small enough for an outside hospital to compare with its own plans.
What the Tainan branch and National Cheng Kung University Hospital reported on 6 November 2026
Cheng Chih-yang, who directs the Smart Healthcare Management Center at the Tainan branch, described the hospital's demonstration. According to the release, the team completed post-quantum protection and testing of TLS 1.3 connections through a gateway, with no effect on hospital operations and no changes to the internal hospital information system (HIS) or its databases. TLS is the protocol that encrypts traffic between a browser or application and a server; version 1.3 is the current one.
Lu Chia-yen, a technical adviser at a data-services company, explained the method behind such deployments: a reverse-proxy gateway placed in front of services that exchange data in FHIR format. A reverse proxy receives connections on behalf of the hospital's servers. The quantum-resistant encryption therefore runs between the outside caller and the gateway, while the older systems behind it keep working as before. This is how the hospital avoided rewriting its HIS.
Chen Pei-yin, head of the information office at National Cheng Kung University Hospital, a large medical center in the same city, walked through the algorithms NIST has standardized and reported a pilot of post-quantum transport encryption on the hospital's cross-hospital integrated care platform. NIST published the first of those standards, FIPS 203 for the ML-KEM key-encapsulation mechanism, on 13 August 2024. The release does not say which algorithm either hospital used, or whether the gateway combines a post-quantum key exchange with a classical one.
FHIR, the HL7 standard for exchanging health data, matters here for a practical reason. It moves patient data between hospitals and apps through ordinary web interfaces, over the same TLS connections a gateway can wrap. Those web interfaces are also where a hospital's data leaves its own network, which makes them the first place to protect.
Quantum pillar: post-quantum cryptography. Technology readiness: TRL 7 of 9. This is our provisional reading of the organizers' account: a working gateway protected live hospital connections in a pilot, which places it at the prototype stage in the real setting, before broad rollout across hospitals and before any published, independent test results.
Why health data comes first in Taiwan's post-quantum plan
The threat behind the seminar has a short name, harvest now, decrypt later. An attacker can copy encrypted traffic today and keep it until a capable quantum computer can break the public-key methods used to set up that encryption. Wang Chin-cheng, deputy director at III's Cybersecurity Institute, warned that this matters most for sensitive health data that hospitals must keep for many years.
The national framework for this work dates from 16 April 2025, when the Administration for Digital Industries and Taiwan's post-quantum industry alliance released the country's first post-quantum cryptography migration guideline, version 1.00, written by III and the industry alliance. Its migration roadmap sets out four steps: build a quantum-readiness plan, inventory cryptographic assets, discuss readiness plans with technology suppliers, and check the readiness of the supply chain. At the 2025 launch, according to Central News Agency reporting, III's Hsiao Jung-hsing explained the logic with data lifetimes: household registration data may need protection for 50 to 70 years, while some web transaction data matters for about three months.
Medical data sits at the long end of that range. A diagnosis, a genome or a psychiatric note sent between hospitals today can still harm the patient decades from now. That is why the panelists put long-lived health data at the top of their risk ranking, ahead of short-lived traffic.
Hospitals elsewhere face the same question about their own connections. Forescout's October 2026 healthcare report, which we covered in our note on post-quantum readiness of medical devices, measured how far medical devices have moved toward post-quantum-capable protocols, and our daily briefing on two November 2026 internet scans of SSH and HTTPS hosts looked at the same question for ordinary servers. A gateway in front of hospital services is one way to close part of that gap without waiting for every system behind it to be replaced.
How the panel ordered the hospital migration, from the outer services inward
The closing panel, chaired by National Cheng Kung University Distinguished Professor Wang Yu-min, brought together the ministry, III, the two hospitals and the program's advisers. The release summarizes their shared advice in four points.
First, inventory. Hospital systems are complex and often built by outside contractors, so the panel advised automated scanning tools to find every place cryptography is used: external service interfaces, internal data flows, system accounts and passwords, and program source code. Second, risk. Because health data is kept long and is highly private, harvest-now-decrypt-later exposure should be assessed first, with the highest-risk connections handled first.
Third, order. The panel recommended working from the outside in: public-facing services and boundary connections first, such as online appointment booking, data exchange between hospitals and remote login. Fourth, continuity. A gateway and reverse proxy can upgrade connection protection while a bypass route keeps clinical services running if something fails. The panelists also stressed crypto-agility, the ability to swap algorithms later as international standards change.
III and the foundation said they will keep offering hospitals consulting, cryptographic asset scanning and migration roadmaps, together with security vendors.
What hospital IT and procurement teams can take from the Tainan pilot
According to the Tainan account, the gateway approach left the core clinical software and databases untouched while protecting connections to the outside. The release does not describe the internal side. In a typical reverse-proxy design, connections between the gateway and the systems behind it would need their own protection unless the internal network is trusted or secured separately, and data already stored in databases and backups would still depend on how it is encrypted at rest. The healthcare professional certificates the ministry has prioritized involve digital signatures, which a gateway for connection encryption would not by itself replace.
For a chief information officer, the Taiwanese example offers a workable order of steps: inventory, rank by data lifetime, protect external connections through a gateway, then move inward to certificates and stored data. For procurement teams, it adds a contract question for every new clinical system and integration vendor: can the product adopt NIST's post-quantum algorithms, ML-KEM for key establishment and the separate signature standards for certificates, without a full replacement, and has the vendor shown that it works with the hospital's other systems?
The evidence remains thin in one important respect. The public account is a press release from the organizers. A published test report from the Tainan branch, with the algorithms, performance overhead and failure behavior, would let other hospitals judge whether the pilot carries over to their own networks.
Sources
Primary source: the press release by the Institute for Information Industry and the National Cheng Kung University Research and Development Foundation on their post-quantum migration seminar for FHIR-based hospital settings of 6 November 2026, distributed by the Central News Agency business wire on 10 November 2026 (in Chinese). Also drawn on: NIST's FIPS 203, the HL7 FHIR specification, Taiwan's post-quantum cryptography migration guideline of 16 April 2025, Central News Agency reporting on its launch, and earlier Quentir coverage.