Abstract
The proliferation of neurotechnology, personalized medicine, and interconnected health ecosystems has created a critical nexus of challenges. The most intimate and sensitive biological data — neural signals — must traverse expansive digital networks to be clinically useful. Simultaneously, these networks are fundamentally vulnerable to the impending threat of cryptographically-relevant quantum computers (CRQCs), which will render current public-key cryptography obsolete and expose lifelong personal data to Harvest Now, Decrypt Later attacks. Compounding this technical insecurity, the design and implementation of these technologies frequently exclude the very populations they are meant to serve, violating fundamental human rights enshrined in the UN Convention on the Rights of Persons with Disabilities (CRPD), specifically Article 9 on Accessibility.
This dissertation addresses the confluence of these three pressing issues by proposing, designing, and formally evaluating the Quantum-Safe Accessible Data Fabric (QS-ADF). The QS-ADF is a novel systems architecture that synthesizes four foundational pillars into a cohesive and actionable framework: HL7 FHIR for semantic interoperability, CRPD Article 9 for universal and disability-inclusive design, NIST FIPS 203/204/205 for post-quantum cryptographic assurance, and NIST SP 800-207 (Zero Trust Architecture) for the operational security model.
This thesis makes the following key contributions: (1) the formal specification of a novel architectural framework that co-synthesizes these four often-disparate domains; (2) the introduction of new system constructs — Accessibility Tokens and Bio-Adaptive UX — that operationalize accessibility as a first-class security and interoperability requirement; (3) a formal threat model analysis demonstrating the resilience of QS-ADF against current and future quantum-era adversaries; and (4) a comprehensive policy-to-practice mapping that translates abstract human rights mandates into concrete, testable technical controls. The final contribution is a detailed implementation roadmap and evaluation plan, offering a path from academic concept to real-world deployment, thereby ensuring the next generation of health data infrastructure is not only secure against future threats but is radically inclusive by construction.
Contribution C1
Architectural synthesis of four mandates
Contribution C2
Accessibility Tokens & Bio-Adaptive UX
Contribution C3
Operationalizing CRPD Art. 9 as code
Contribution C4
PQC threat model & evaluation plan
Introduction
Three independent crises — an interoperability problem, a cryptographic cliff, and a civil-rights failure — converge on the same data. This chapter frames their intersection.
1.1 The Emerging Neurotechnology and Digital Health Paradox
The first decades of the twenty-first century have witnessed an unprecedented acceleration in the convergence of medical technology and digital infrastructure. Neurotechnology, in particular, has transitioned from a purely clinical research tool to a nascent consumer and therapeutic market. Brain-Computer Interfaces (BCIs) promise to restore function for individuals with paralysis, treat intractable neurological conditions, and eventually augment cognitive capabilities. Concurrently, the paradigm of personalized medicine is built upon the seamless and secure exchange of vast amounts of patient data. However, this rapid technological advancement has created a fundamental paradox: the most sensitive and identity-defining data — an individual's neural signals — must be readily accessible across broad clinical and research networks to be useful, yet this very accessibility creates a profound and growing security and privacy risk.
1.2 The Impending Quantum Threat to Long-Lived Health Data
This vulnerability is not merely a function of current malware or insider threats. A more insidious and existential danger looms: the development of cryptographically-relevant quantum computers (CRQCs). The public-key cryptographic algorithms that currently secure virtually all digital communication — RSA and Elliptic Curve Cryptography (ECC) — are mathematically proven to be broken by Shor's Algorithm once a sufficiently powerful quantum computer is realized. The threat is two-fold. First, a future CRQC could break the security of data currently being transmitted. Second, and more critically for health data, is the Harvest Now, Decrypt Later (HNDL) attack. An adversary can intercept and store encrypted health records today — records with a legal retention horizon of decades, often a lifetime — and simply wait until a CRQC becomes available to decrypt them. For an individual's BCI-derived neural map or genomic sequence, which is immutable, this is a catastrophic, permanent privacy violation.
1.3 The Accessibility Imperative: A Civil Rights Problem in Digital Infrastructure
Simultaneous to these technical challenges, a third, deeply ethical issue persists: the systematic exclusion of people with disabilities from the design and use of health technologies. The UN Convention on the Rights of Persons with Disabilities (CRPD) establishes that access to information and communications technologies is a fundamental human right, not a privilege. Article 9 mandates that technology be usable by all on an "equal basis." However, modern health portals, medical device software, and even the BCIs designed to assist people are frequently built without genuine user-centered input from the disability community, resulting in interfaces that demand fine motor control, acute vision, or uninterrupted attention. This digital exclusion can lead to medical errors, loss of autonomy, and the denial of critical care, effectively creating a two-tiered system of access that harms the most vulnerable. The principle of radical inclusion by construction must be a core design goal.
1.4 The Need for a Unified Architectural Framework
Existing research and development efforts address these three domains in silos. Cybersecurity experts focus on post-quantum cryptography. Health IT professionals champion interoperability standards like HL7 FHIR. Disability advocates and policymakers champion accessibility mandates. However, there is a critical gap: no existing framework provides a comprehensive, unified architecture that addresses all three challenges simultaneously. Bolting cryptography onto a legacy interoperable system without considering accessibility creates a system that is secure but unusable by a significant portion of the population. Creating an accessible system without PQC leaves it vulnerable to future existential threats. The need is for an architectural philosophy that treats security, interoperability, and accessibility not as separate features, but as three interlocking, non-negotiable properties of a trustworthy system.
1.5 Research Questions and Objectives
Central research question
How can a unified system architecture be designed to simultaneously enforce post-quantum security for highly sensitive neural data, ensure semantic interoperability for clinical utility, and mandate accessibility for all users by design?
Sub-questions
How can the abstract principles of CRPD Article 9 be formally modeled as machine-readable, testable technical requirements within a healthcare IT ecosystem?
What is an optimal strategy for integrating NIST's post-quantum cryptographic algorithms (FIPS 203/204/205) into an FHIR-based healthcare infrastructure to mitigate Harvest-Now-Decrypt-Later attacks?
How can a Zero Trust Architecture (NIST SP 800-207) be extended to incorporate "accessibility context" as a first-class signal in its continuous verification and policy evaluation processes?
What system constructs (new FHIR resources, data structures) are required to create a tamper-evident, quantum-safe chain of custody for high-stakes neural data?
How can the resulting architecture be practically implemented and its efficacy and usability be empirically validated?
1.6 Thesis Contributions
C1 · Architectural Synthesis
Formal specification of the QS-ADF, co-synthesizing HL7 FHIR, CRPD Art. 9, NIST PQC and Zero Trust.
C2 · Conceptual Constructs
Accessibility Tokens to embed accommodation needs in authorization flows; Bio-Adaptive UX for a real-time biometric↔interface loop.
C3 · Operationalizing Ethics
A policy-to-practice mapping translating CRPD Art. 9 into auditable technical controls and data schemas.
C4 · Security Posture Analysis
A formal threat model demonstrating resilience against classical and quantum-era adversaries, including cognitive-load attacks.
C5 · Implementation Roadmap
A phased implementation plan and empirical validation strategy from specification to pilot deployment.
C6 · Certification Model
The "QS-ADF Conformant" mark, unifying cryptographic validation (CAVP/CMVP) with accessibility audit (EN 301 549 / Section 508).
1.7 Document Structure
Chapter 2 reviews the literature across the four core domains and identifies the research gap. Chapter 3 outlines the Design Science Research methodology. Chapter 4 presents the high-level QS-ADF architecture. Chapter 5 provides a deep dive into the novel constructs. Chapter 6 conducts the threat model analysis. Chapter 7 details the implementation and evaluation roadmap. Chapter 8 discusses implications; Chapter 9 concludes and proposes future work.
Literature Review & Theoretical Foundations
A critical review across four foundational domains, establishing the theoretical grounding for QS-ADF and demonstrating the need for an integrated approach.
2.1 The State of Health Data Interoperability: HL7 FHIR
HL7's Fast Healthcare Interoperability Resources (FHIR) has emerged as the de facto standard for exchanging health data (Braunstein, 2019; Bender & Sartipi, 2019). Unlike HL7 v2 and the formal but rigid v3, FHIR is designed for web-based implementation, leveraging RESTful APIs and promoting modularity. Its core building blocks — "Resources" — capture the vast majority of clinical and administrative data in a standardized format.
- Strengths: FHIR's flexibility and pragmatism. Its resource model is extensible through profiles and extensions, making it adaptable to novel use cases. Community-driven Implementation Guides (IGs) have been pivotal.
- Limitations: FHIR specifies data exchange but delegates security and privacy to other standards (OAuth 2.0, SMART-on-FHIR; Mandel et al., 2016). Critically, the standard does not specify quantum-safe provenance signing, and its data model has no first-class support for capturing a patient's accessibility requirements — treating them as free-text notes rather than a machine-readable attribute.
2.2 The Quantum Threat Landscape and NIST Standardization
Modern digital infrastructure relies on the computational intractability of integer factorization (RSA) and the discrete logarithm problem (ECC). Shor's 1994 algorithm demonstrated that a sufficiently powerful quantum computer could solve both in polynomial time (Shor, 1997). NIST's multi-year global competition culminated in 2024 with three published standards.
ML-KEM
Module-Lattice-Based Key-Encapsulation Mechanism. Replaces RSA/ECC for all key establishment, including TLS 1.3 handshakes.
ML-DSA
Module-Lattice-Based Digital Signature Algorithm. Routine signing of FHIR Provenance, device attestations, clinician signatures.
SLH-DSA
Stateless Hash-Based Digital Signature. Reserved for high-assurance roots of trust and signatures valid beyond a 20-year horizon.
Migration challenges. The primary challenge is not algorithm creation but algorithm migration. Healthcare is notoriously slow to adopt new infrastructure, and the cost of a cryptographic-agility overhaul is substantial (Ott et al., 2020; Mosca & Mulholland, 2017). A hybrid approach — combining classical and post-quantum algorithms during transition — is pragmatic but potentially vulnerable if not implemented correctly (Bindel et al., 2019). QS-ADF addresses this with a concrete, phased migration strategy tailored to a health data fabric.
2.3 Zero Trust Architecture: A Paradigm Shift
The traditional "castle-and-moat" model, which assumes everything inside a network perimeter is trusted, has proven inadequate. NIST SP 800-207 formalizes Zero Trust Architecture (Rose et al., 2020), operating on "never trust, always verify."
Continuous Verification
Trust is never granted implicitly based on network location; it is continuously evaluated against contextual signals.
Least-Privilege Access
Subjects receive only the minimum access necessary for their function, for the minimum duration.
Assume Breach
Architecture designed to limit the blast radius of compromise rather than to prevent entry absolutely.
Micro-segmentation
The network is decomposed into isolated segments to prevent lateral movement between data classes.
QS-ADF adopts ZTA as its foundational operational security model and advances the literature by integrating accessibility context into the ZTA Policy Decision Point — ensuring the security model is not only resilient but dynamically inclusive.
2.4 Accessibility as a Foundational Principle: WCAG → CRPD Article 9
The W3C's Web Content Accessibility Guidelines (WCAG) serve as the global technical standard, organized around the POUR principles — Perceivable, Operable, Understandable, Robust (Kirkpatrick et al., 2018). However, the legal and ethical foundation is the CRPD (United Nations, 2006). Article 9 imposes a positive obligation on states to ensure access to ICTs "on an equal basis with others" — going beyond technical conformance checklists. The CRPD recognizes accessibility as a precondition for the enjoyment of all other rights.
2.5 Neuroethics and the Governance of Neural Data
The governance of neural data is central to contemporary neuroethics (Ienca & Haselager, 2016; Goering et al., 2021). The unique qualitative nature of neural data — its proximity to cognition, emotion and identity — has led scholars to argue for enhanced protections, often termed "neurorights" (Yuste et al., 2017):
- Mental Privacy: the right to keep one's mental processes and neural signatures private.
- Identity and Agency: protection of personal identity and decision-making autonomy from manipulation or algorithmic bias.
- Fairness and Bias: ensuring algorithms interpreting neural data do not produce discriminatory outcomes, particularly for people with disabilities.
QS-ADF incorporates these ethical concerns into technical design: cryptographic non-repudiation via
Provenance chains and WORM integrity logs directly address data-manipulation
concerns, while Accessibility Tokens ensure neurotechnologies enhance rather than diminish autonomy.
2.6 Identified Gap
Research Methodology & Design Science Paradigm
QS-ADF is an engineered artifact. The research therefore follows a Design Science Research (DSR) paradigm, structured around the three canonical cycles: relevance, design, and rigor.
3.1 Rationale for a Design Science Research Approach
Design Science Research is appropriate where the research goal is the creation and evaluation of an artifact — a construct, model, method, or instantiation — intended to solve an identified organizational or societal problem. QS-ADF produces all four artifact types: constructs (Accessibility Tokens, Bio-Adaptive UX), models (the three-plane architecture), methods (the PQC migration procedure), and instantiations (the pilot implementation).
3.2 Research Design and Methodology Phases
Figure 3.1 — The DSR relevance, design and rigor cycles mapped onto the QS-ADF research programme.
3.3 Methods for Literature and Requirements Analysis
- Systematic literature review across four databases (ACM DL, IEEE Xplore, PubMed, Scopus) with a defined inclusion/exclusion protocol.
- Standards traceability analysis: clause-by-clause extraction from CRPD Art. 9, WCAG 2.2, NIST FIPS 203/204/205 and SP 800-207.
- Semi-structured interviews with disability advocates, clinicians, and health-security architects (target n = 24, thematic analysis).
3.4 Methods for Artifact Design and Construction
- Architecture description using ISO/IEC/IEEE 42010 viewpoints, with formal UML 2.5 sequence and component diagrams.
- FHIR profiling via StructureDefinition and Implementation Guide authoring, validated against the HL7 validator.
- Reference implementation in a containerised testbed: HAPI FHIR server, OpenSSL/BoringSSL with PQC providers, Keycloak with an extended PDP.
3.5 Methods for Evaluation
Proof of Concept
Functional pilot of the Quantum-Safe Clinician workflow end-to-end.
Threat Modelling
STRIDE extended to STRIDE-PQC, covering quantum-era and cognitive vectors.
Usability Testing
Co-design sessions and WCAG-EM audits with participants with disabilities.
The QS-ADF Architectural Framework
Four mandates, three control planes, one data plane — all operating under Zero Trust. This chapter specifies the architecture in full.
4.1 Architectural Overview: The Four Pillars and Three Planes
Figure 4.1 — The four foundational mandates are not features bolted onto a system; they are the axes of its design space.
Figure 4.2 — The reference architecture. Every vertical transition is a re-authentication event; every horizontal transition within the data plane is blocked by default.
4.2 The Interoperability and Interface Plane (The Translator)
FHIR APIs are the only permitted ingress and egress points for clinical and neural data. The plane enforces rate-limiting, schema validation, and routing to internal microservices, while the Adaptive UI/UX Middleware realises CRPD Art. 9 technically:
- Detects the user's assistive technology (AT) profile from the Accessibility Token.
- Transforms raw
ObservationandDiagnosticReportresources into accessible outputs — tactile or sonified neural charts for blind users, simplified executive-function views for ADHD/dysexecutive profiles, sign-language avatars for Deaf users. - BCI command interfaces must support dwell-time, blink, switch control, and assistive toggles — never "exclusive" motor inputs.
Core resources: Patient, Observation, DiagnosticReport, Device, Provenance, Consent, Communication. Implementation Guides define standardized profiles for EEG, fMRI, LFP (Local Field Potentials) and Polygenic Risk Scores so that a BCI's output is machine-readable across vendors and jurisdictions.
4.3 The Cryptographic Core (The Vault)
Transit: TLS 1.3 with FIPS 203 (ML-KEM) key exchange hybridized with classical ECDHE for backward compatibility during the migration window. SMART-on-FHIR + OAuth 2.0 + PKCE handle authorization, with PKCE swapped for ML-DSA-signed authorization objects.
WORM Evidence Integrity: Consent records, BCI output logs, and chain-of-custody audit trails are hashed with SHA-3 and signed with FIPS 204 (ML-DSA). Hashes are anchored to a tamper-evident ledger — a permissioned blockchain or an RFC 9162 Certificate Transparency-style log — to satisfy non-repudiation. If a neural interface ever influences a financial, legal, or medical decision, the evidentiary chain is mathematically unalterable, including against future quantum adversaries.
4.4 The Micro-Segmented Data Plane
Figure 4.3 — A billing-system compromise cannot traverse to the Neural Data Lake without quantum-safe credentials.
Segmentation: neural signal data is segregated from demographic data, billing data, and free-text clinical notes. Micro-segmentation: cross-segment traffic requires re-authentication and PQC-based mTLS.
Formalizing Novel Constructs
Two new system constructs make accessibility a policed property of the fabric rather than a user-side patch: Accessibility Tokens and Bio-Adaptive UX.
5.1 Accessibility Tokens: A Formal Model for Machine-Readable Accommodation
The Accessibility Token embeds a user's specific accommodation requirements directly into the security and authorization fabric. Unlike a static preference stored in a database, it is a dynamic, cryptographically signed claim issued by a trusted authority (e.g., a hospital system or a user-managed identity provider) and evaluated by the Zero-Trust Policy Decision Point.
Formal definition. Let an Accessibility Token A_T be a JWT-like structure containing a set of claims C = {c₁, c₂, …, cₙ} defining required modalities for interaction:
AT = ( Header , Payload , Signature )
Figure 5.1 — The token travels with every request, allowing the PDP to evaluate authorization and accommodation in a single policy decision.
When a SMART-on-FHIR client requests a resource (e.g., a complex DiagnosticReport),
it presents its OAuth 2.0 access token along with A_T. The PDP verifies both
authorization ("Is this patient allowed to see this report?") and the
accessibility_context. It then instructs the Adaptive UI/UX Middleware to render
the returned FHIR resource in a format that is semantically correct and inherently usable by the
requestor.
5.2 Bio-Adaptive UX: Integrating Biometric Feedback into Interface and Security Loops
QS-ADF goes beyond static WCAG conformance. Algorithms processing neural data must include Accessibility Kill Switches: if biometric stress (HRV, GSR, EEG frontal-alpha asymmetry) indicates cognitive overload, the system automatically simplifies the interface, lowers frame rates, halts animation, and reduces information density.
Figure 5.2 — Biometric signals become a first-class risk input to the Policy Decision Point, closing the loop between physiology, security posture, and interface complexity.
Predictive cognitive-load scoring feeds biometric and interaction telemetry into the Zero-Trust PDP as a risk signal: high predicted load triggers step-up authentication, simpler layouts, and longer timeouts. Forced confirmation and omission alerts support users with intradimensional set-maintenance deficits (ATN literature; Aggleton et al., 2022): the UI requires explicit confirmations on destructive or high-impact actions and proactively highlights skipped steps.
5.3 The WORM Evidence Integrity Chain
Figure 5.3 — Consent records, BCI output logs and chain-of-custody trails form an unalterable evidentiary chain.
5.4 Equitable Accommodation in High-Stakes Proceedings
The framework directly supports accommodations in legal, administrative, and benefits-adjudication contexts:
- AAQOC-aligned interfaces (Attention, Arousal, Working memory, Inhibition, Cognitive flexibility) are surfaced as named UI modes.
- Audit-grade recall aids — a "Nine-Report Integrity Layer" produces a redundant, time-stamped, PQC-signed narrative of all user actions, supporting recall-based (not familiarity-based) evidentiary review.
- CRPD Art. 13 / Art. 29 compliance — interfaces used in access-to-justice scenarios must be operable without fine motor control and must externalize working memory.
Threat Model Analysis & Security Evaluation
A formal threat model extends STRIDE to STRIDE-PQC, incorporating quantum-era adversaries and adversarial interface attacks.
6.1 Methodology
Threats are enumerated per trust boundary (planes, segments, and the human–interface boundary), classified under STRIDE, then re-evaluated under a post-quantum adversary assumption in which RSA and ECC provide zero confidentiality. A third pass adds cognitive threat classes that traditional models ignore.
| Threat vector | Severity | Pre-quantum risk | QS-ADF mitigation |
|---|---|---|---|
| Harvest Now, Decrypt Later | CRITICAL | RSA-encrypted data is stored in bulk; decrypted when CRQCs arrive. | All data in transit uses ML-KEM (FIPS 203); stolen ciphertext is useless to future quantum adversaries. |
| Medical device spoofing | CRITICAL | A rogue BCI or insulin pump connects to the network and impersonates a legitimate device. | Zero-Trust engine demands device attestation signed with SLH-DSA (FIPS 205). |
| Data poisoning / manipulation | HIGH | Attacker alters a patient's MRI or neural mapping to induce misdiagnosis. | FHIR Provenance is hashed and signed with ML-DSA (FIPS 204); any mutation breaks the chain. |
| Digital exclusion | HIGH | New technology demands fine motor control, vision, or hearing; users are silently locked out. | CRPD Art. 9 mandates alternative I/O modalities; the API enforces this via Accessibility Tokens. |
| Insider threat / lateral movement | HIGH | Compromised billing system pivots to neural data. | Micro-segmentation + PQC-mTLS prevents lateral traversal. |
| Long-horizon forgery | MEDIUM | A signature valid in 2025 must remain valid in 2055; the algorithm does not survive. | SLH-DSA (FIPS 205) for any signature with a >20-year validity horizon. |
| Cognitive-overload attack (CoDoS) | MEDIUM | Adversarial UI induces seizures, panic, or errors in users with cognitive disabilities. | Bio-Adaptive UX + Accessibility Kill Switches auto-degrade the interface under physiological stress. |
| Downgrade attack on hybrid TLS | MEDIUM | Attacker forces negotiation to classical-only cipher suites during migration. | PDP policy requires PQC-bearing handshakes for Tier 0 segments; classical-only sessions are denied outright. |
| Token replay / scope creep | LOW | Stolen Accessibility Token replayed to escalate accommodations or read scope. | Short expiry (≤ 15 min), holder-of-key binding to a PQC device key, and audience restriction. |
6.2 Resilience Against Cognitive and Adversarial UI Attacks
Traditional threat models focus on confidentiality, integrity and availability. QS-ADF extends the model to include Usability and Safety as primary security properties, recognising that for users with cognitive disabilities an interface can itself be a threat vector.
QS-ADF mitigation: the Bio-Adaptive UX kill switch
- Detection. The middleware monitors biometric signals (HRV, GSR from a wearable, or EEG features from a BCI) as a safety signal and detects a threshold breach of physiological stress.
- Response. The system immediately triggers a "safe mode": it halts non-critical animations, reduces information density, lowers alert frequency, and simplifies the interface to its most essential functions. A tactile or audio cue informs the user.
- Recovery. Safe mode persists until biometric signals return to baseline, preventing a sustained CoDoS attack and ensuring user safety.
Implementation, Evaluation & Policy Roadmap
A three-phase migration from cryptographic-agility audit to a quantum-safe clinician pilot, with a 28-week validation programme.
Figure 7.1 — Phases overlap deliberately: hybrid mode is live before any classical algorithm is retired.
7.1 Phase 1 — Cryptographic Agility Audit (Weeks 1–6)
- Inventory all cryptographic libraries across medical devices, FHIR servers, and identity providers.
- Identify hard-coded RSA/ECC dependencies; flag them for migration.
- Deploy a Hybrid Mode (classical + PQC) at the TLS and signing layers; ensure legacy clients still work.
7.2 Phase 2 — FIPS Integration (Weeks 6–24)
- Key establishment: upgrade TLS 1.3 handshakes to negotiate ML-KEM (FIPS 203).
- Digital signatures: use ML-DSA (FIPS 204) for routine signing of FHIR
Provenance, device attestations, and clinician countersignatures; use SLH-DSA (FIPS 205) for long-term Root CA keys, lifetime "Master Consent" records, and any signature valid beyond a 20-year horizon. - Key management: migrate HSMs to PQC-capable firmware; rotate all Root CA keys with overlap periods sufficient to redistribute the trust chain.
7.3 Phase 3 — The "Quantum-Safe Clinician" Workflow
Figure 7.2 — Doctor and patient both know, via accessible channels, that the neural data is unaltered.
- A clinician opens a patient's neural report on a workstation.
- The SMART-on-FHIR client requests the
DiagnosticReportand itsProvenanceresource. - The server returns the payload, signed with ML-DSA.
- The client verifies the signature against an SLH-DSA-signed public key infrastructure.
- The UI displays a "Quantum Integrity Verified" badge — itself rendered as an ARIA live region so screen-reader users receive the same assurance.
7.4 Mapping to Compliance Frameworks
| Framework | Obligation | QS-ADF realisation |
|---|---|---|
| HIPAA Security Rule 45 CFR § 164.312 | Access controls (§ 164.312(a)(1)); audit controls (§ 164.312(b)) | Zero-Trust PDP enforces access; WORM Evidence Integrity Chain provides audit controls exceeding the rule's baseline. FIPS 204/205 signatures on Provenance give auditable proof of integrity. |
| GDPR Art. 5(1)(f), Art. 32 | Integrity and confidentiality; "state of the art" security | Adoption of NIST PQC standards provides a defensible argument that the controller has implemented the most robust available measures against future threats — decisive for long-lived health data. |
| ADA Title II / Section 508 | Accessible electronic and information technology | Accessibility Tokens and the Adaptive UI/UX Middleware are a direct, auditable implementation — moving beyond static checklists to a dynamic, user-centric model. |
| European Accessibility Act / EN 301 549 | Harmonised accessibility requirements for ICT products and services | The proposed "QS-ADF Conformant" mark certifies both cryptographic validation (CAVP/CMVP) and accessibility conformance simultaneously. |
| 21 CFR Part 11 | Electronic records; electronic signatures | ML-DSA clinician countersignatures bound to device keys, with immutable WORM anchoring, satisfy the non-repudiation and record-integrity requirements. |
7.5 A Multi-Phase Empirical Validation Plan
Benchmarking
Measure ML-KEM handshake latency vs. ECDHE, ML-DSA signing throughput on FHIR Provenance, and SLH-DSA root-signing cost within the certificate rotation window.
Accessibility audit
WCAG-EM evaluation of the Adaptive UI/UX Middleware outputs with assistive-technology users (screen reader, switch access, AAC).
Red-team exercise
Adversarial simulation of CoDoS, downgrade, and lateral-movement scenarios against the pilot testbed.
Field study
Longitudinal deployment with a national health information exchange and disability-advocacy partners.
Discussion & Implications
8.1 Theoretical Contributions: Bridging Disparate Domains
QS-ADF demonstrates that security, interoperability and accessibility are not competing constraints but mutually reinforcing properties. An accessibility token is simultaneously a security claim; a quantum-safe provenance chain is simultaneously an accessibility assurance (the badge a screen-reader user hears). The thesis offers a generalisable design pattern — policy-enriched context objects — applicable wherever a system must reason about both who a subject is and how that subject can perceive.
8.2 Practical Implications
- Health systems gain a migration path that does not require a disruptive "big bang" cut-over.
- Neurotechnology vendors gain a certification target that differentiates on trust and inclusion rather than raw capability.
- Clinicians gain cryptographic assurance they can verify and communicate to patients.
8.3 Policy and Governance Implications
The framework argues for treating accessibility conformance and cryptographic validation as a single procurement gate. It also supports calls for a statutory "neural data" category with enhanced retention and deletion obligations, backed by the integrity guarantees the architecture supplies.
8.4 Limitations
Conclusion & Future Work
Securing neurotechnology and healthcare data against quantum threats cannot be achieved by bolting encryption onto a legacy system. It requires an architectural shift that simultaneously treats HL7 FHIR as the lingua franca of clinical and neural data, Zero Trust as the rule of engagement for every actor and packet, FIPS 203/204/205 as the immutable locks for confidentiality, integrity, and long-horizon non-repudiation, and CRPD Article 9 as the ethical boundary that keeps the system inclusive for every human user.
9.1 Next Steps
- Standards engagement: convene a working group to define HL7 FHIR Implementation Guides for PQC-based
Provenancesignatures and Accessibility Tokens. - Pilot deployment: stand up an SLH-DSA Root CA for a national health information exchange; pilot ML-KEM TLS 1.3 across all API gateways.
- Compliance mapping: publish a checklist mapping WCAG 2.2 criteria, CRPD Art. 9 sub-paragraphs, and FIPS 200-series controls onto BCI and neurotech control schemes.
- Accessibility certification: establish a "QS-ADF Conformant" mark combining cryptographic validation (CAVP/CMVP) with an accessibility audit (EN 301 549 / Section 508).
- Empirical validation: partner with disability-advocacy organisations and accessibility researchers to field-test Bio-Adaptive UX in real clinical and high-stakes-proceeding contexts.
9.2 Avenues for Future Research
- Formal verification of the accessibility-token policy model using a temporal logic checker.
- Differential-privacy mechanisms for neural data shared across research consortia.
- Post-quantum secure multi-party computation for cross-institutional neural-model training.
- Longitudinal study of Bio-Adaptive UX efficacy for users with acquired brain injury.
References
- Alagic, G., Alperin-Sheriff, J., Apon, D., Cooper, D., Dang, Q., Kelsey, J., … & Liu, Y. K. (2022). Status report on the third round of the NIST post-quantum cryptography standardization process. NIST Interagency Report 8413-upd1.
- Bender, D., & Sartipi, K. (2019). HL7 FHIR: An Agile and RESTful approach to healthcare information exchange. IEEE 30th International Symposium on Computer-Based Medical Systems (CBMS), 491–496.
- Bindel, N., Brendel, J., Fischlin, M., & Günther, F. (2019). Hybrid key encapsulation mechanisms and authenticated key exchange. In Post-Quantum Cryptography (pp. 206–226). Springer.
- Braunstein, M. L. (2019). Health informatics on FHIR: How HL7's new API is transforming healthcare. Springer.
- Goering, S., Klein, E., Specker Sullivan, L., Wexler, A., Agüera y Arcas, B., Bi, G., … & Yuste, R. (2021). Recommendations for responsible development and application of neurotechnologies. Neuroethics, 14(3), 365–386.
- Ienca, M., & Andorno, R. (2017). Towards new human rights in the age of neuroscience and neurotechnology. Life Sciences, Society and Policy, 13(1), 1–27.
- Kirkpatrick, A., O'Connor, J., Campbell, A., & Cooper, M. (Eds.). (2018). Web Content Accessibility Guidelines (WCAG) 2.1. W3C Recommendation.
- Mandel, J. C., Kreda, D. A., Mandl, K. D., Kohane, I. S., & Ramoni, R. B. (2016). SMART on FHIR: a standards-based, interoperable apps platform for electronic health records. Journal of the American Medical Informatics Association, 23(5), 899–908.
- Mosca, M., & Mulholland, J. (2017). Cybersecurity in an era with quantum computers: will we be ready? IEEE Security & Privacy, 15(5), 38–41.
- National Institute of Standards and Technology. (2023). FIPS Publication 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard. U.S. Department of Commerce.
- National Institute of Standards and Technology. (2023). FIPS Publication 204: Module-Lattice-Based Digital Signature Standard. U.S. Department of Commerce.
- National Institute of Standards and Technology. (2023). FIPS Publication 205: Stateless Hash-Based Digital Signature Standard. U.S. Department of Commerce.
- Ott, D., Peikert, C., et al. (2020). Identifying research challenges in post-quantum cryptography migration and cryptographic agility. arXiv preprint arXiv:1909.07353.
- Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture. NIST Special Publication 800-207.
- Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5), 1484–1509.
- United Nations. (2006). Convention on the Rights of Persons with Disabilities. Treaty Series, 2515, 3.
- Yuste, R., Goering, S., Arcas, B. A. Y., Bi, G., Carmena, J. M., Carter, A., … & Wolpaw, J. (2017). Four ethical priorities for neurotechnologies and AI. Nature, 551(7679), 159–163.
Appendices
Appendix A — FHIR StructureDefinition for an Accessibility Token claim
An illustrative profiling of Consent extended with a machine-readable accessibility context, registered in the QS-ADF Implementation Guide.
{
"resourceType": "StructureDefinition",
"id": "qs-adf-accessibility-context",
"url": "https://example.org/qs-adf/StructureDefinition/accessibility-context",
"version": "1.0.0",
"name": "AccessibilityContext",
"title": "QS-ADF Accessibility Context",
"status": "draft",
"fhirVersion": "5.0.0",
"kind": "complex-type",
"abstract": false,
"type": "Extension",
"baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension",
"context": [
{ "type": "element", "expression": "Consent" },
{ "type": "element", "expression": "Patient" },
{ "type": "element", "expression": "Communication" }
],
"differential": {
"element": [
{ "id": "Extension", "path": "Extension", "short": "Machine-readable accommodation requirements" },
{ "id": "Extension.extension:modalities", "path": "Extension.extension", "sliceName": "modalities", "max": "1" },
{ "id": "Extension.extension:modalities.value[x]", "path": "Extension.extension.value[x]", "type": [{ "code": "code" }] },
{ "id": "Extension.extension:inputMethod", "path": "Extension.extension", "sliceName": "inputMethod", "max": "1" },
{ "id": "Extension.extension:cognitiveProfile", "path": "Extension.extension", "sliceName": "cognitiveProfile", "max": "1" },
{ "id": "Extension.extension:streamingPriority", "path": "Extension.extension", "sliceName": "streamingPriority", "max": "1" }
]
}
}
Appendix B — JSON Schema for accessibility_context
The formal structure of accessibility preferences embedded within an Accessibility Token.
{
"$schema": "http://json-schema.org/draft-07/schema#",
"$id": "https://example.org/qs-adf/schemas/accessibility-context.schema.json",
"title": "Accessibility Context",
"description": "A machine-readable set of claims describing a user's required accommodations for interacting with a QS-ADF system.",
"type": "object",
"properties": {
"preferred_modalities": {
"type": "array",
"description": "The user's preferred input and output modalities.",
"items": {
"type": "string",
"enum": ["screen-reader", "braille-display", "high-contrast",
"sign-language-avatar", "text-to-speech", "speech-to-text"]
},
"minItems": 1,
"uniqueItems": true
},
"input_method": {
"type": "string",
"description": "The primary method the user employs to interact with the system.",
"enum": ["keyboard", "mouse", "touch", "switch", "dwell-time",
"eye-gaze", "bci-motor-imagery", "bci-ssvep", "aac-device"]
},
"cognitive_profile": {
"type": "string",
"description": "An optional profile indicating a need for cognitive supports.",
"enum": ["default", "adhd", "autism-spectrum",
"intellectual-disability", "abi", "dementia", "low-literacy", null]
},
"needs_simplified_layout": {
"type": "boolean",
"description": "If true, the UI should present a simplified, low-density layout.",
"default": false
},
"requires_confirmation": {
"type": "boolean",
"description": "If true, the system must request explicit confirmation for all destructive or high-impact actions.",
"default": false
},
"streaming_priority": {
"type": "string",
"description": "Optional network priority, relevant for assistive devices requiring low-latency data.",
"enum": ["normal", "high", "critical"],
"default": "normal"
},
"needs_audit_recall_aids": {
"type": "boolean",
"description": "If true, the system should provide a clear, time-stamped summary of all actions taken in a session.",
"default": false
}
},
"required": ["preferred_modalities", "input_method"]
}
Appendix C — PQC Root CA rotation procedure (SLH-DSA)
- Prepare. Provision a PQC-capable HSM partition with CAVP-validated SLH-DSA firmware. Verify the firmware attestation before generating any key material.
- Generate. Create the SLH-DSA keypair inside the HSM boundary; the private key never leaves the module. Record the algorithm parameter set (e.g.,
SLH-DSA-SHA2-128s) in the CA metadata. - Self-sign & publish. Issue a self-signed root certificate with a validity horizon matched to the >20-year requirement. Publish to the trust-store distribution endpoint and the transparency log.
- Overlap. Keep the outgoing root valid for a defined overlap window (minimum 2× the certificate distribution cycle) so dependent device trust chains can be re-issued.
- Re-issue subordinates. Re-sign all intermediate and device certificates under the new root using ML-DSA for routine credentials.
- Anchor. Write the rotation event to the WORM ledger as a signed record with SHA-3 digest, providing an immutable audit trail of the trust-chain cut-over.
- Retire. After the overlap window, move the outgoing root to a revocation-only state; never delete its public material, as historical signature verification must remain possible.
Appendix D — CRPD Article 9 → WCAG 2.2 → QS-ADF control mapping
| CRPD / policy requirement | WCAG 2.2 anchor | QS-ADF technical control |
|---|---|---|
| "Information must be provided in accessible formats." | 1.1.1, 1.3.1, 4.1.2 | FHIR R5 Communication and Consent resources encode accessibility preferences. Adaptive UI/UX Middleware transforms responses into ARIA-compliant, screen-reader-ready, high-contrast, or sonified outputs. |
| "Accessible emergency services." | 2.1.1, 2.5.7 | BCIs and assistive devices expose a FHIR API endpoint allowing wheelchair / AAC / environmental controls to traverse the same network as health data, secured with PQC-mTLS to prevent malicious hijack. |
| "Privacy of personal data." (Art. 22) | — | Neural data is micro-segmented; access requires PQC-authenticated, time-bound tokens. Biometric templates never leave the device. |
| "Education and lifelong learning." (Art. 24) | 3.1.5, 3.2.4 | Cognitive-accessibility profiles (ADHD, autism, intellectual disability, acquired brain injury) are first-class citizens in the FHIR profile registry. |
| "Access to justice." (Art. 13) | 2.2.1, 3.2.6 | AAQOC-aligned UI modes, forced confirmation, and the Nine-Report Integrity Layer externalise working memory and provide audit-grade recall aids. |
| "Participation in political and public life." (Art. 29) | 2.5.1, 2.5.4 | Interfaces operable without fine motor control; single-switch and dwell-time input are mandated by policy in the PDP. |