begin: PHI Column Encryption

2026-06-22 21:18:36 +08:00
parent 518cc5b99a
commit 46db694820
21 changed files with 3177 additions and 6 deletions
@@ -0,0 +1,18 @@
+public class PhiEncryptionOptions
+{
+    public const string Section = "PhiEncryption";
+
+    /// <summary>
+    /// Purpose string for IDataProtector. Rotate by changing purpose and re-encrypting.
+    /// </summary>
+    public string ProtectorPurpose { get; set; } = "VigilCare.PatientPhi.v1";
+
+    /// <summary>
+    /// HMAC key for name search tokens (base64). Separate from encryption key.
+    /// In production: store in Key Vault, not appsettings.
+    /// </summary>
+    public string SearchTokenKey { get; set; } = null!;
+
+    /// <summary>When true, logs PHI access for list/search operations as aggregate events.</summary>
+    public bool LogListAccess { get; set; } = true;
+}