Which Healthcare Connections Should You Encrypt First?

Start with the connections that carry patient data: EHR integrations, imaging systems (PACS), and connections to external laboratories or care partners. These are the healthcare connections you should encrypt first, because they contain the most sensitive data while also running most frequently over shared or external network infrastructure. For most healthcare organisations, the rule is: the higher the risk of interception and the more sensitive the data, the higher the priority. In this article, we answer the most frequently asked questions about encryption in healthcare, from data vulnerability to quantum-safe security.

Which data in healthcare organisations is most vulnerable to interception?

The most vulnerable data in healthcare organisations includes patient records, medical imaging data, diagnostic results, and financial healthcare information. This information is valuable to attackers because it is directly traceable to individuals and falls under strict privacy legislation. Precisely because healthcare organisations continuously exchange this data between departments, locations, and external parties, the risk of interception is structurally present.

Specifically, the following categories are involved:

• Electronic health records (EHR): contain medical history, medication, and diagnoses
• Medical imaging data (PACS/DICOM): large files that often travel unencrypted across internal networks
• Laboratory results and pathology reports: sensitive and time-critical
• Financial and insurance data: attractive for identity fraud
• Communication between healthcare professionals: such as messaging about patient treatment

What makes this data particularly vulnerable is that it often flows through multiple systems and parties: from hospital to general practitioner, from laboratory to specialist, from healthcare organisation to insurer. Every link in that chain is a potential attack point. Encrypting healthcare connections is therefore not an optional measure, but a basic requirement for responsible data security.

Which connections are at greatest risk without encryption?

Connections between locations, to external care partners, and to cloud environments are at greatest risk without encryption. These are so-called WAN connections or inter-site links where data travels over networks that are not fully under your control. Without encryption, it is relatively easy for an attacker to intercept or manipulate traffic.

The connections with the highest risk profile in a healthcare network are:

• Connections between hospital sites or healthcare organisations: data travels over shared infrastructure
• Links with external laboratories, pharmacies, or general practices: limited control over the receiving infrastructure
• Connections to cloud platforms for EHR storage or medical applications
• Remote access for healthcare staff: working from home and accessibility from outside the organisation
• Medical IoT devices: monitoring equipment, infusion pumps, and other connected systems with limited built-in security

Internal traffic within a single building or campus is often considered safer, but unencrypted data traffic is a risk there as well. Especially when multiple departments, visitors, or external suppliers have access to the same physical network. Protection of sensitive data starts with insight into which connections are unsecured and what data flows over them.

How do you determine the order of encryption in a healthcare network?

You determine the order of encryption based on two factors: the sensitivity of the data travelling over a connection and the likelihood that the connection will be intercepted. Connections with high risk and high data sensitivity receive priority. This is a risk-based approach that aligns with common security frameworks for the healthcare sector.

A practical prioritisation looks as follows:

1. External connections carrying patient data: links to external care partners, laboratories, and cloud platforms
2. Inter-site connections: WAN connections between locations of the same organisation
3. Remote access connections: external access to internal systems
4. Internal backbone connections: connections between core infrastructure and critical systems
5. IoT and medical device connections: monitoring systems and connected medical equipment

Start with a network audit to gain insight into which connections are unencrypted and what data flows over them. Combine this with a threat analysis: which connections are most accessible to an attacker? That combination gives you a clear priority list. Encryption is not a one-time project, but an ongoing process in which you repeat the inventory periodically as your network grows or changes.

What is the difference between layer 1, layer 2, and application encryption in healthcare?

Layer 1 encryption encrypts at the physical level of the connection itself, layer 2 encryption operates at the data link level, and application encryption protects data within a specific application or protocol. In healthcare, the location of encryption within the OSI model determines how much of the network is actually protected and what performance trade-offs you make.

Layer 1 encryption: security at the physical level

Layer 1 encryption encrypts all data traffic at the level of the physical connection, for example a fibre optic cable. This is the most transparent form of encryption: the network experiences virtually no latency and all traffic over that connection is automatically secured, regardless of the protocol or application. For healthcare organisations with fibre connections between locations, this is a powerful first line of defence. Our encryption solutions include layer 1 security for critical healthcare connections.

Layer 2 encryption: security at the network segment level

Layer 2 encryption operates at the level of Ethernet frames and protects traffic between network segments or locations. It offers more flexibility than layer 1 and is suitable for Carrier Ethernet connections or MPLS networks. Latency is slightly higher than with layer 1, but still low enough for most healthcare applications, including real-time image transfer.

Application encryption: security at the software level

Application encryption, such as TLS in a web browser or end-to-end encryption in a messaging app, protects data at the level of the application itself. The advantage is that the data remains protected even outside the network. The disadvantage is that only the traffic from that specific application is encrypted. Traffic from other applications or systems on the same network remains unsecured. In healthcare, application encryption is a supplement, not a replacement for layer 1 or layer 2 encryption.

The most robust approach combines multiple layers: layer 1 or 2 for the connection itself, supplemented by application encryption for specific systems such as EHR portals and communication platforms.

Does a healthcare organisation need to comply with NEN 7510 for network encryption?

Yes, NEN 7510 requires healthcare organisations in the Netherlands to implement appropriate technical measures to protect patient data, and network encryption is explicitly included. The standard does not prescribe a specific technology, but does require that you can demonstrably show you have considered the risks and taken appropriate security measures. Encrypting healthcare connections is therefore not optional, but a compliance requirement.

NEN 7510 is based on ISO/IEC 27001 and contains specific requirements for information security in healthcare. Relevant considerations for network encryption include:

• Risk analysis: you must demonstrate which connections are at risk and what measures you have taken
• Access security: only authorised parties may be able to view or intercept patient data
• Secure data transmission: data travelling over external or shared networks must be encrypted
• Logging and monitoring: you must be able to demonstrate that your security measures are working and that you detect anomalies

In addition to NEN 7510, the GDPR and, for larger organisations, the NIS2 directive also play a role. Together, these frameworks place high demands on the demonstrability of your security measures. A well-documented encryption strategy is therefore also a compliance document.

When is quantum-safe encryption needed for healthcare connections?

Quantum-safe encryption is already relevant for healthcare organisations that process sensitive data over the long term. The threat of quantum computing is real: attackers are already collecting encrypted traffic today to decrypt it later, once quantum computers become available. Medical data has an exceptionally long sensitivity period, making the healthcare sector particularly vulnerable to these so-called “harvest now, decrypt later” attacks.

In practical terms, this means you need to start thinking about quantum-resistant algorithms now, even though quantum computers are not yet operational at scale. The transition to post-quantum cryptography takes time: systems need to be evaluated, vendors need to be involved, and migrations need to be planned. If you wait too long, you risk data you send today being decrypted five or ten years from now.

For healthcare organisations, the following priorities apply when transitioning to quantum-safe encryption:

• Connections carrying data that remains sensitive for decades, such as genetic information or long-term treatment histories
• Connections to external parties where you have less control over security standards
• Critical infrastructure connections that also fall under NIS2

We help healthcare organisations map their current encryption environment and plan a phased transition to protection against quantum threats. We always do this vendor-independently, so the choice fits your infrastructure and planning, not a specific product. Want to know where you stand? Our experts are happy to think along with you through our security solutions for healthcare.