Beyond Secure Messaging: Anurag Lal on the Future of Healthcare Communication, Cybersecurity and Digital Trust

Healthcare communication is entering a new phase, where the ability to exchange information securely is becoming just as important as the speed at which it is shared. Hospitals have spent years securing their records systems, but patient data is most exposed when it is in use: shared between clinicians, discussed across departments or sent to external partners. The communication network has become one of the most important places where sensitive data moves, and one of the weakest links in healthcare cybersecurity.

This shift is particularly relevant as healthcare organisations move away from informal messaging channels towards enterprise-controlled platforms. Kauvery Hospitals’ deployment of NetSfere across its network, covering more than 12,000 users and over 100 teams, reflects this transition. The three-year initiative is aimed at establishing a centrally governed communication environment that supports clinical coordination while strengthening information security and data governance.

NetSfere, the secure enterprise communications platform from Infinite Convergence Solutions, operates at the intersection of enterprise messaging, collaboration and cybersecurity. Its focus on end-to-end encryption, centralised administrative control and quantum-resilient security raises a larger question for healthcare leaders: how can hospitals enable faster collaboration, inside and beyond their own walls, without giving up control of sensitive patient information?

In this conversation, Anurag Lal, President and CEO of NetSfere, draws on his extensive experience in technology, wireless communications, telecom, and enterprise platforms to discuss the evolving security challenges facing healthcare organisations. He explains why centralised control is what makes a secure platform mandatory rather than optional, why no single security capability is enough on its own, and how federated communication can connect healthcare ecosystems without compromising data control. He also discusses India’s data protection landscape, AI security, the growing asymmetry between attackers and defenders, and what hospitals must do today to prepare for 2030.

1. Healthcare communication often involves highly sensitive clinical and patient information, yet many organizations have historically relied on consumer messaging platforms. Why does this remain a significant security and governance challenge for healthcare providers?

Consumer apps win on speed and familiarity, and clinicians will always choose the fastest route to reach a colleague. The problem is that the hospital does not own those accounts. It cannot enforce policy, remove a departed employee from a conversation, control where files are stored or produce an audit trail. Patient information then sits in personal threads, backups, and screenshots that the organisation cannot see. Under India's data protection regime, the hospital remains accountable for that information wherever it travels. The fix is not a stricter policy. It is giving staff an approved channel that is as fast as the one they already use.

2. Kauvery's deployment involves more than 12,000 users across 100+ teams and multiple hospital locations. From a technology standpoint, what are the key considerations when moving an organization of this scale from fragmented communication tools to a centrally governed platform?

Four things matter most at this scale. First, identity: every user must be verified and mapped to the appropriate role and location. Second, role-based access, so clinicians and administrators have the permissions they need. Third, delegated administration, allowing individual hospitals to manage their teams within centrally defined policies. Fourth, adoption. The transition should be designed around real clinical workflows, such as ward handovers and specialist consultations, so that security does not introduce unnecessary friction.

3. NetSfere combines end-to-end encryption, centralized governance, auditability, India-based data hosting, and quantum-resilient security. Which of these capabilities do you believe will become most critical for healthcare organizations over the next three to five years, and why?

Centralized governance, supported by auditability, will become increasingly important. Encryption protects the confidentiality of communication, while governance helps organizations control access, apply policies, and maintain appropriate records. As India's DPDP framework moves through phased implementation, healthcare leaders will need to demonstrate how they protect personal data and meet their applicable obligations. Post-quantum cryptography adds another layer of long-term protection for information that may remain sensitive for decades.

4. The healthcare ecosystem rarely operates within the boundaries of a single organization. Hospitals interact with laboratories, pharmacies, insurers, technology providers, referring physicians, and other partners. How can secure communication evolve to enable collaboration across these organizational boundaries without compromising data control?

By replacing informal workarounds with trust relationships between organisations. Today, a referral often travels over a personal phone number or a shared email address, and nobody can verify who is on the other end. The better model is that each organisation keeps its own identity, policies, and records, and agrees with its partners what can be shared, with whom and for what purpose. Access should be scoped to that purpose, revocable at any time and visible to both sides. Collaboration should extend across boundaries, but control over data should not.

5. NetSfere has recently introduced Federations, designed to allow organizations to securely communicate across organizational and geographic boundaries while retaining control over their own data and governance. What could this model mean for complex healthcare ecosystems in particular?

Federation creates a governed way for organizations to communicate with verified contacts across organizational boundaries. A hospital could use this model to collaborate with partner laboratories, referring physicians, or other healthcare organizations while each party retains control over its own directory and governance. NetSfere Federations allows organizations to publish selected contact information without copying or synchronizing their directories. The aim is to make cross-organizational communication more controlled and accountable, rather than leaving staff to rely on informal workarounds.

6. With AI accelerating the volume and speed of enterprise communication, how should healthcare organizations rethink their security architecture? Are traditional perimeter-based approaches still sufficient in an increasingly connected and AI-enabled environment?

No. A perimeter assumes that everything inside is trusted, and that no longer holds with mobile devices, external partners and AI tools reading content. Security must extend to identities, devices, data, and individual interactions. Organizations should assess what information an AI feature can access, where that information is processed, whether it is shared with third parties, and how existing access controls apply. AI capabilities should operate within clearly defined security and governance boundaries, with appropriate safeguards for sensitive clinical information.

7. Quantum-resilient security is increasingly being discussed as a long-term requirement rather than a distant concept. Why is it relevant for healthcare organizations today, given the long-term sensitivity and value of health data?

Healthcare data can remain sensitive for decades. That makes the harvest-now, decrypt-later risk relevant today: an attacker could collect encrypted communications now and attempt to decrypt them in the future as cryptographic capabilities evolve. Moving to post-quantum cryptography takes planning, so organizations should assess their cryptographic dependencies before quantum computers capable of breaking current public-key cryptography become available. NetSfere uses ML-KEM-1024, standardized by NIST in FIPS 203, as part of its quantum-resilient communications architecture. Healthcare organizations should consider the longevity and sensitivity of their data when evaluating communication security.

8. Beyond protecting messages and files, how can secure communication platforms contribute to better clinical workflows, faster decision-making, and ultimately better patient outcomes?

Security is what makes speed safe. When clinicians trust the channel, they use it for what matters: urgent results, handovers, specialist opinions, and escalation. Care-team groups, voice and video within the same conversation, and acknowledgement rules reduce phone tag and ambiguity about who is responsible. I would not claim that messaging alone improves outcomes. What it does is remove avoidable delay and uncertainty from the moments where they matter most, and that is where better decisions come from.

9. What do you see as the biggest cybersecurity blind spots for healthcare organizations over the next five years, not just from a technology perspective, but also in terms of people, processes, and organizational culture?

I see five major blind spots. First, AI adoption: healthcare organizations are rapidly embracing AI, but many are not yet addressing the risks around data exposure, unauthorized use of AI tools, and governance of AI-generated insights. Second, quantum readiness: organizations need to start preparing for the possibility that future quantum computers could compromise today's widely used encryption methods. The harvest-now, decrypt-later threat makes post-quantum cryptography an important consideration today, not just in the distant future. Third, End-to-end encryption: protecting sensitive clinical conversations requires encryption that ensures only the intended participants can access the information, without relying on intermediaries to decrypt it. Fourth, third-party exposure: partners and vendors having access to sensitive information without regular reviews of permissions and security practices. Fifth, process gaps: former employees retaining access, excessive permissions, and downtime plans that have never been properly rehearsed can create significant vulnerabilities. Ultimately, healthcare cybersecurity is no longer just about protecting networks and devices. It is about protecting the entire communication ecosystem, including people, processes, partners, and the technologies shaping the future.

10. Looking ahead, what will the secure healthcare communication environment of 2030 look like, and what should hospitals begin doing today to prepare for it?

By 2030, I believe secure healthcare communication will be built around four important pillars: end-to-end encryption, post-quantum cryptography, governed collaboration across healthcare ecosystems, and responsible AI integration. Healthcare organizations will need communication platforms that protect sensitive clinical conversations, support secure collaboration across hospitals and external care partners, and incorporate AI capabilities with appropriate access controls and privacy safeguards. At NetSfere, we are scaling our global presence across North America, Europe, and Asia-Pacific, including markets such as the US, Germany, Singapore, Malaysia and India, with healthcare emerging as a strategic focus area. We see healthcare organizations as early adopters of secure, governed communication because the stakes are particularly high: patient confidentiality, clinical coordination, regulatory compliance, and continuity of care.

Our work with Kauvery Hospital is a good example of this transition. Kauvery is using NetSfere as its secure enterprise communication platform to help healthcare teams collaborate while moving away from fragmented, informal communication channels. With thousands of clinical staff and a multi-location hospital network, secure and reliable communication is essential to coordinated patient care. Hospitals should start preparing now by identifying the communication channels their employees actually use, consolidating clinical communication into approved and secure environments, establishing clear access and escalation policies, and regularly rehearsing downtime scenarios. They should also assess their privacy and security frameworks against applicable regulations, including India's DPDP requirements.

Stay tuned for more such updates on Digital Health News