Question

A healthcare SaaS company is building a new patient-records platform on AWS. Regulatory requirements mandate that Protected Health Information (PHI) fields such as Social Security Numbers must be encrypted, but the application must still be able to perform exact-match lookups on these values (for example, to find a patient by SSN) without decrypting the entire dataset. The team wants to minimize the exposure of raw PHI in the primary application database, which runs on Amazon Aurora PostgreSQL. Which design best meets these requirements?

Accepted Answer

Replace raw SSNs with format-preserving tokens generated by a dedicated tokenization service; store the token in Aurora and keep the token-to-value mapping in a separate, tightly access-controlled encrypted vault, indexing on the deterministic token for lookups.

Answer

Enable Aurora storage-level encryption with AWS KMS and store the SSN as a plaintext column, relying on the encrypted volume to satisfy the confidentiality requirement.

Answer

Encrypt each SSN client-side with a randomized AES-GCM key per record before storing it in Aurora, and perform lookups by decrypting all rows in the application layer at query time.

Answer

Store SSNs in Aurora with column-level encryption using a KMS asymmetric key pair, and decrypt values on the database server during each query using a stored procedure.