Post-Quantum Cryptography for securing Electronic Health Records in the South African Public Healthcare System

The growing dependency on Electronic Health Records (EHRs) has intensified the exposure of sensitive patient information to advanced cybersecurity threats, including those posed by quantum computing technologies. South African public hospitals depend on conventional encryption mechanisms to secure EHRs; however, these methods are susceptible to quantum threats. The study explored quantum-resistant cryptography for securing EHRs in South African healthcare. The study adopted a phenomenological approach, employing semi-structured interviews with 12 ICT specialists, policymakers, health information managers and cybersecurity practitioners. The study established a misalignment between national digital health and cybersecurity strategies and future quantum threats, as they prioritise digital transformation, data security and interoperability. Public hospitals were found to be reliant on conventional encryption methods, resulting in structural lock-in and impeding adaptability of post-quantum cryptography. Although stakeholders demonstrated awareness of quantum threats, organisational readiness remains constrained by technical, institutional and capacity barriers. It is concluded that South African public healthcare system remains behind towards post-quantum security transformation. The study recommends the development of a roadmap for post-quantum cryptographic migration, system modernisations and capacity building to strengthen the security of EHRs. The findings provide evidence-based guidance for policymakers to strengthen digital health security and resilience of EHRs in public healthcare systems.