Skip to main content

Pattern 4: Encrypting Temporal Data

The final core pattern is handling sensitive dates, such as a date of birth. This is critical for regulations like HIPAA. The pattern is the same: encrypt the precise value but extract and preserve a less-sensitive derivative for analytics.

The Pattern​

For a sensitive date field:

  1. Encrypt the full date_of_birth.
  2. Calculate and Preserve a useful but less precise value, such as the age_range.
  3. Delete the original plaintext date.

Implementation​

You will add this final piece of logic to your existing mapping processor.

  1. Start with your Pipeline: Open the encrypt-pii.yaml file from Step 2. (Note: for simplicity, we are skipping the address step for this example).

  2. Add the Date Encryption Logic: Add the logic for the date_of_birth field to the bottom of the existing mapping processor.

    See the complete configuration for the maintained encryption mapping and its ciphertext fields.

    Note: This step uses a separate TEMPORAL_ENCRYPTION_KEY. Ensure you have set it as an environment variable.

Verification​

When you run your data through the updated pipeline, the customer object will now be fully protected. The sensitive date_of_birth is encrypted, but a useful age_range has been preserved for demographic analysis.

You have now learned the four core patterns for encrypting different types of sensitive data while preserving business value.