Question

A healthcare SaaS provider must supply realistic data to an offshore development team for building a new reporting feature. The dataset contains patient records with PHI. Developers need referential integrity across tables and must run repeatable test cases, but they should never see real patient identifiers, and the masked copy will be stored in a persistent non-production database. Which data protection approach best fits these requirements?

Accepted Answer

Static data masking that irreversibly substitutes PHI with consistent surrogate values before the dataset is loaded into the non-production environment

Answer

Dynamic data masking applied at query time against the production database so developers query live data with masked results

Answer

Format-preserving encryption of the PHI columns with the decryption keys shared with the offshore team

Answer

Row-level access control policies that hide PHI columns from the developers' database role