[definitelyauser]

Health data primarily.

You aim to encrypt the fields you can, without hampering usability too much.

Anything you need to be able to search for (name, ssn) to find patients, or filter on for reports, is generally plaintext.

More sensitive things such as "that patient has aids" you'll have to decide if you want to encrypt it, or do a massive select from the DB anytime you need statistics on it. (Or better yet, encrypt it, but store an anonymized tracker elsewhere. But this is less useful for cureable diseases)

[h1fra]

oh I forgot about that indeed. I guess the proposed solution in the article would not even be useful since a filtering on a encrypted boolean would not work and there is no way to "hide" this value.

Is it okay if everything is plaintext but the name? In that case you have a row of sensitive data without anything to link to the actual patient if it leaks.

[e12e]

Sometimes the fact that someone is a patient is sensitive. Eg an abortion clinic.