Skip to content

Onset Patient Privacy Vault

Standalone encryption/decryption service for clinic patient PII.

This must be deployed separately from the clinic portal. The clinic app should hold only:

  • PATIENT_PRIVACY_SERVICE_URL
  • PATIENT_PRIVACY_SERVICE_TOKEN

The clinic app must not hold PATIENT_PII_ENCRYPTION_KEY in production.

Secrets

Set these on the vault deployment only:

wrangler secret put PATIENT_PII_ENCRYPTION_KEY
wrangler secret put PRIVACY_SERVICE_TOKEN

Set this on the clinic app only:

PATIENT_PRIVACY_SERVICE_URL=https://<vault-worker-url>
PATIENT_PRIVACY_SERVICE_TOKEN=<same token as vault>

Operations

The vault supports:

  • encrypt
  • decrypt
  • batchDecrypt
  • hash

The hash operation is used for email lookup and uniqueness. It returns a SHA-256 hash of normalized email.

Custody Model

Database admins see only ciphertext and blind indexes.

Clinic app admins do not receive the encryption key. They can only access the vault through the scoped service token.

For stricter custody, put this Worker in a separate Cloudflare account/project and restrict who can view Worker secrets.