Addressing quantum readiness in healthcare security. John Frushour, New York-Presbyterian CISO, Urges Post-Quantum Cryptography Action Marianne Kolbasuk McGee (HealthInfoSec) - June 18, 2026 10 Minutes Healthcare organizations should focus on practical quantum readiness rather than fear-driven predictions about sudden cybersecurity disruption, said John Frushour, vice president and CISO of New York-Presbyterian Hospital. Quantum-resistant technologies already exist through standards and encryption methods that many organizations can access today. Preparing for Q-Day is achievable without dramatic operational changes, he said. Healthcare leaders, along with organizations in other regulated sectors, continue to monitor post-quantum cryptography while balancing present-day security priorities, he said. Commercial software and service providers play a significant role in helping enterprises adopt quantum-resistant capabilities, Frushour said. In addition, healthcare organizations will potentially benefit by long-term opportunities quantum computing creates through advanced computation, stronger encryption and the ability to analyze anonymized data more effectively, he said during an ISMG interview conducted at the recent HealthSec conference in Boston. "I think first of all - just be wary of the hype, as with anything in cybersecurity, but also be prepared for the future," he said. "Ensure that if you can get on your load balancers or your hosted infrastructure, if you can get to strong TLS 1.3 and strong ciphers, get there. You're probably not going to break anything by doing so," he said. In this audio interview (see link below photo), Frushour also discussed: * Post-quantum cryptography readiness and how National Institute of Standards and Technology guidelines help; * Quantum risks involving healthcare and biomedical devices; * How artificial intelligence combined with quantum computing could improve security forecasting. Frushour, who joined New York-Presbyterian Hospital in 2016, previously held several security management and leadership roles at technology firms, including Nuance, where he served as director of security operations. Prior to that, he held technology management positions in the U.S. Marine Corps, including director of tactical networks. He is a member of the CyberEdBoard.

Vance admits to stealing Geisinger patient information in data breach. * by LARRY DEKLINSKI THE NEWS-ITEM * mar 11, 2026 updated mar 12, 2026 * 0. WILLIAMSPORT - Max Vance has admitted to stealing personal data of 1.31 million Geisinger patients while working for third-party vender Nuance Communications. Vance, also known as Andre Burk, has pleaded guilty to a federal count of obtaining information from a protected computer. The files contained personally identifiable and protected health information, including patients' name, date of birth, address, admit and discharge code, medical record number, race, gender, phone number and care location. Chief U.S. District Judge Matthew Brann directed the U.S. Probation Office to conduct a pre-sentence investigation and prepare a pre-sentence report. The government levied two additional counts of providing false statements against Vance for allegedly telling the FBI that he did not download unauthorized data. In a filing this week, Vance asked the court for immediate release from custody, arguing that he will likely receive a sentence less than the amount already served in jail. Brann has not yet ruled on the matter. According to the U.S. Attorney's Office, Vance worked as a principal health-care interface engineer within the health-care division of Nuance Communications, which provides software solutions to health care providers. Geisinger contracted Nuance to develop and upgrade its health-care software within its computer network. Employees working on the contract had access to certain Geisinger computer systems. Nuance fired Vance for unrelated misconduct on Nov. 27, 2023. Two days later, the defendant used his company laptop to log into Geisinger's computer system and run several queries of Geisinger's servers for numerous categories of private patient information, which he then downloaded onto his laptop. As a result of the breach, numerous patients filed lawsuits against Geisinger and Nuance, which were eventually consolidated into a class action lawsuit. The complaint alleges Geisinger discovered and notified Nuance of the breach on Nov. 29, 2023, but neither party notified victims until June 24, 2024, ensuring that Vance could monetize, misuse or disseminate the information. In November, Brann gave preliminary approval of a $5 million settlement. This month, the plaintiffs filed a motion for final approval. According to the proposed settlement, the funds can be used for approved claims up to $5,000, per affected patient, for documented out-of-pocket expenses; attorneys' fees not to exceed $1.67 million; and $2,000 each to class representatives Amber Lopez, Thomas Wilson, Brenda Everett, Ralph Reviello and James Wierbowski. Court documents show that 97,217 claims have been submitted, for a rate of 7.63%, as of March. 4. There have been no objections to the settlement, and 53 class members have opted out. Larry Deklinski can be reached at 570-644-6397, ext. 1353, or [email protected].