A healthcare organization is implementing a new customer service system where call center representatives need to verify patient identities but should not have access to full Social Security Numbers or complete credit card details. The organization wants to maintain the original data format while protecting sensitive information from unauthorized viewing. Which data protection method should be implemented?