public class PhiEncryptionOptions
{
    public const string Section = "PhiEncryption";

    /// <summary>
    /// Purpose string for IDataProtector. Rotate by changing purpose and re-encrypting.
    /// </summary>
    public string ProtectorPurpose { get; set; } = "VigilCare.PatientPhi.v1";

    /// <summary>
    /// HMAC key for name search tokens (base64). Separate from encryption key.
    /// In production: store in Key Vault, not appsettings.
    /// </summary>
    public string SearchTokenKey { get; set; } = null!;

    /// <summary>When true, logs PHI access for list/search operations as aggregate events.</summary>
    public bool LogListAccess { get; set; } = true;
}