Data Encryption

CentriCare implement End-to-End Encryption (E2EE) to information that considered as part of PHI. Encryption are done in two ways, Deterministic Encryption and Random Encryption.

graph TD
	subgraph C[Client]
		PHI[Protected Information]
		P[Presentation]
		E[Encryption]
		
		PHI -->|encrypt| E
		E -->|decrypt| P
	end
	S[Server]
	DB[Database]
	
	E <-->|exchange| S
	S -->|store encrypted data| DB

Configuration

Encryption and decryption must be consistent across the CentriCare ecosystem to maintain data integrity. That's why you need to follow these standard configuration.

1. Use AES-256-CBC algorithm with IV derived from the plain text (using HMAC) for deterministic encryption
2. Use AES-256-GCM algorithm with random IV in this format {iv}:{authTag}:{encryption} (each part use hex encoding) for random encryption
3. Every organization will get their own secret key to encrypt and decrypt information. Changing these key must be followed by re-encryption process using the new key
4. Use deterministic encryption for queryable data or data that will be used as query parameter. And use random encryption for data that will never be used as query parameter
5. Only specific part of data or document need protection that will be encrypted (Selective Field-Level Encryption)