Nexus Intelligence
What is changing in healthcare AI, and why it matters — each item separated into the source fact, Nexus analysis, and the review it should trigger.
About this terminal: lenses, sourcing, and what signing in adds
What is changing in healthcare AI, and why it matters. Eight lenses — threats, healthcare breach intelligence (Canada · United States · Caribbean), regulation, workforce, crisis, biosecurity, quantum risk, and the sovereignty movement — each item separated into the source fact, Nexus analysis, and the review it should trigger.
Public terminal. Sourced items are stated as the cited source reports them; analysis blocks are Nexus editorial inference and are labelled as such. Signed-in workspaces add organization-specific intelligence preferences and link items to your own controls.
How to read this terminal: labels, sources, and the threat-level method
What kind of statement is this?
- FACT
- A reported event or published document, stated as the cited source reports it.
- INFERENCE
- Nexus analysis of what the facts mean for healthcare AI governance. Reasoned, attributable, revisable.
- FORECAST
- A forward-looking expectation. Never presented as a fact; always attributed to Nexus analysis.
Each card separates the source fact (what the cited source reports) from Nexus analysis (what we think it means) and a recommended review (what a governance team should check). Analysis is editorial and attributable to Nexus; it is never presented as fact.
How urgent is it?
- FLASH
- A discrete, dated event with direct healthcare impact (breach, ransomware, regulation in force, outbreak). Recency-weighted into the threat level for 90 days.
- PRIORITY
- Material development or standing condition that should reach the governance agenda this cycle. Weighted into the threat level for 90 days at a lower rate than FLASH.
- ROUTINE
- Background context, standing facts, or slow-moving trends. Never moves the threat level.
Where is it in its life?
- LIVE
- Published by the daily collection agent since the last editorial refresh. Live items are collected and de-duplicated automatically; editorial review has not yet been recorded.
- ACTIVE
- Currently tracked. The situation is ongoing or its consequences are still unfolding.
- RESOLVED
- Closed by the source, or auto-resolved after 14 days without an update. Kept for the historical record, collapsed by default.
- STALE
- No update from any source in 30 days. Treat the details as possibly out of date.
How can I verify it?
- PRIMARY SOURCE
- Linked directly to the regulator, agency, vendor disclosure, or standards body that originated the information.
- SECONDARY SOURCE
- Linked to reputable reporting about the event rather than the originating body.
- SOURCE LINKED
- A source link is provided; primary/secondary tier has not been recorded for this item.
- SOURCE CITED · NO LINK
- The source is named but no link is recorded. Verify with the named source before acting.
- NEXUS TRACKING
- Derived from Nexus's own workforce or signal collection rather than an external publication.
- HUMAN REVIEWED
- An editor has reviewed the item against its source.
- REVIEW PENDING
- Collected automatically; editorial review has not yet been recorded.
Confidence scores, validation status, and human-review state appear only when a feed genuinely records them. When they are absent, they are absent — Nexus does not invent them.
How is the threat level calculated?
- FLASH within 7 days: 3 points · FLASH within 90 days: 2 points · older FLASH: 0.5
- PRIORITY within 90 days: 1 point · older PRIORITY: 0.25
- ROUTINE: 0 points
- CRITICAL
- Three or more FLASH items inside the last 7 days — a live cluster, right now.
- ELEVATED
- At least one FLASH item inside 7 days, or a weighted score of 8 or more. The news-rich resting state.
- GUARDED
- Weighted score of 3 or more with no FLASH in the last 7 days.
- LOW
- Weighted score below 3.
The threat level is an editorial urgency gauge over items in this terminal. It is not a probability, not a prediction, and not calibrated against incident outcomes. Use it to decide what to read first, not whether you are safe.
Quantum Threat Intelligence
Patient records must stay confidential for 50+ years — longer than any classical encryption deployed today can promise. NIST's post-quantum standards are finalized, banks have inventoried their cryptography, and adversaries are already harvesting ciphertext. This feed tracks the quantum clock as it runs against healthcare. Sector posture: GUARDED.
FACTFLASHHARVEST NOW'Harvest Now, Decrypt Later' Campaigns Targeting Hospital Networks
Threat actors are exfiltrating encrypted archives from healthcare networks with no intention of decrypting them today. Patient records remain sensitive for a lifetime — mental health, genetics, reproductive care — so ciphertext stolen in 2026 and broken by a future quantum computer is still a catastrophic breach. Classical encryption strength is irrelevant to this attack; only quantum-resistant re-encryption closes it.
FACTFLASHPQC DEADLINEGoogle's 2029 PQC Deadline: Healthcare Unprepared
Google has set 2029 as the point where its infrastructure and partners must be post-quantum ready, and browser/TLS ecosystems are moving on the same clock. Financial services are mid-migration; the healthcare sector, with the longest-lived sensitive data of any industry, has barely begun a cryptographic inventory. A typical hospital scores single digits on quantum readiness.
FACTPRIORITYREGIONAL RISKCaribbean Health Systems Face Dual Threat: Legacy Encryption + Quantum Timeline
Caribbean hospitals run a higher share of legacy systems with outdated cipher suites — some traffic still negotiates protocols deprecated a decade ago — while facing the same 2029-era PQC timeline as everyone else. The migration gap is wider exactly where resources are thinnest, compounding the region's data-sovereignty exposure.
FACTPRIORITYDATA RETENTION50-Year PHI Retention: Why Patient Records Are Prime Quantum Targets
Health records must remain confidential for the patient's lifetime — pediatric records for 50+ years under most retention rules. Any PHI encrypted with classical algorithms today will still be inside its confidentiality window when cryptographically relevant quantum computers arrive. That asymmetry makes hospitals the highest-value 'harvest now' target of any sector.
FACTPRIORITYCBOMCanadian Banks Complete CBOM Assessments — Healthcare Sector Silent
Major Canadian financial institutions have completed Cryptographic Bill of Materials inventories — a full accounting of every algorithm, key length, and protocol touching sensitive data — as the first step of PQC migration. No equivalent motion exists in the hospital sector, which holds data that outlives any banking record by decades.
FACTROUTINEGUIDELINESETSI Releases Quantum-Safe Cryptography Guidelines for Health Data
ETSI's quantum-safe cryptography work now includes profiles relevant to health data in transit and at rest, complementing NIST's algorithm standards with deployment guidance European health systems can adopt directly. Hybrid schemes (classical + PQC) are the recommended transition posture.
FACTROUTINECRYPTO INVENTORYOntario Hospital Alliance Begins Cryptographic Asset Inventory
An early mover: an Ontario hospital alliance has started cataloguing encryption in use across member EHR, imaging, and inter-facility transport systems — the CBOM groundwork the banking sector finished first. It is the first visible sign of Canadian healthcare engaging the PQC timeline.
FACTPRIORITYSTANDARDSNIST Finalizes ML-KEM, ML-DSA Standards for Post-Quantum Migration
FIPS 203 (ML-KEM key encapsulation), FIPS 204 (ML-DSA signatures), and FIPS 205 (SLH-DSA hash-based signatures) are finalized. The era of 'waiting for the standards' is over: every PQC migration plan can now anchor to published federal standards, and regulators will increasingly expect exactly that.
With the standards final, 'waiting for the standards' is no longer a reason to defer. Health records that must stay confidential for decades are the clearest case for starting the cryptographic inventory now.