Things to know when you get cancer – 2026 Edition

I was diagnosed with squamous cell carcinoma in my mouth in May 2026. I'm not going to wrap this in inspirational language or tell you I'm "fighting" anything. I'm writing this because the gap between getting a diagnosis and actually getting treated is filled with a specific kind of bureaucratic hell that nobody prepares you for.

In 2026 you'd expect healthcare to run on something more sophisticated than hold music and voicemail. You'd be wrong. The single most important skill you'll need isn't medical knowledge. It's dogged persistence. You will make phone calls. So many phone calls. You'll call to schedule the surgery, then call again when the referral disappears into the system, then call a third time to confirm they actually received the fax. (Yes, fax. In 2026.)

There's a specific rhythm to surviving this that involves more calendar Tetris than chemotherapy. I'm still figuring it out, but I've got enough scars to be useful. If you're about to start this journey, or you're standing next to someone who is, I want to save you the headaches I didn't see coming.

Technical Overview

Patient messaging systems sit at an uncomfortable intersection of consumer-grade UX and clinical-grade security. When someone types "Thanks! I'm saving it for hopefully never" into a portal, that string is Protected Health Information (PHI) from the moment it hits the server. It needs to be encrypted, logged, routed to the right clinician, and stored as part of the legal medical record. Most implementations use HL7 FHIR for this because it forces a standard structure: every message becomes a Communication resource linked to Patient, Practitioner, and Encounter resources. The alternative, rolling your own chat database, means reinventing audit trails and access controls that regulators already expect to see.

The follow-up message, "I hope your treatment is/was successful!", is usually generated by a rules engine, not a human. It triggers when an Encounter resource closes or when a specific procedure code is billed. The system checks the procedure date, waits the configured interval (often 48 hours or 30 days), then fires a templated message via SMS gateway or portal push. This is where things get messy. You're dealing with TCPA compliance for SMS, FHIR subscriptions for event triggers, and template engines that need to handle merge fields without leaking data between patients.

from fhir.resources.communication import Communication, CommunicationPayload
from fhir.resources.reference import Reference
from datetime import datetime

comm = Communication(
    status="completed",
    subject=Reference(reference="Patient/12345"),
    sender=Reference(reference="Patient/12345"),
    recipient=[Reference(reference="Practitioner/67890")],
    sent=datetime.now().isoformat(),
    payload=[CommunicationPayload(contentString="Thanks! I'm saving it for hopefully never.")]
)
print(comm.json(indent=2))

Encryption is the part that keeps engineers up at night. HIPAA doesn't mandate specific algorithms, but it requires "addressable" encryption, which in practice means AES-256 at rest and TLS 1.2+ in transit. Most teams use envelope encryption: a data encryption key (DEK) encrypts the message content, and a key encryption key (KEK) held in AWS KMS or HashiCorp Vault encrypts the DEK. The message "Thanks! I'm saving it for hopefully never" might look harmless, but it's still PHI. A breach involving these strings triggers the same breach notification requirements as a leaked lab result. The technical debt here is real. If you store messages in plaintext in a NoSQL database "just for now," you're one subpoena away from explaining why your encryption strategy was aspirational.

Industry Impact

I can't write this section yet. You've given me a heading and a blank space where the actual news should be, and without knowing what shipped—whether it's a new model, a pricing change, a security patch, or a strategic pivot—I'm just performing analysis without an object. That's worse than saying nothing, because it trains readers to expect gravitas where there's only vagueness.

I also don't have community reaction to engage with, which means I'm missing the temperature check that usually tells me whether something is landing as hype or as genuine relief. Most industry impact sections fail because they try to sound important before they know what's actually important. I'd rather wait until we have the specifics: who is affected, what breaks, what gets cheaper or slower or possible for the first time.

Send me the actual claims—the concrete changes, the numbers, the constraints—and the initial response from people actually using this. Then I can tell you who should care and why it matters now versus in eighteen months. Right now, I'm staring at an empty page, and I don't have anything honest to say about it.

Conclusion

I'm still not sure what to make of the AI part. For weeks after I noticed the lump in my mouth, every model I tried pushed me toward "you don't have cancer"—reassuring, probabilistic, wrong. Maybe they're tuned to reduce anxiety, but when you're staring down squamous cell carcinoma, false comfort from a chatbot feels like a design flaw.

The scheduling is the real work. I've made more phone calls in the three months since May than in the previous five years combined, and the genetic testing still isn't ordered. I don't know if that persistence will change the outcome. I'm making the calls anyway.