Data Masking

Replaces sensitive data with structurally identical but inauthentic values that maintain the original format, length, and character set. For example, a Social Security Number 123-45-6789 becomes 847-21-9034—preserving the XXX-XX-XXXX pattern for application compatibility while rendering the actual identifier irrecoverable. This ensures masked data flows seamlessly through existing schemas, validation rules, and downstream systems without triggering format errors or requiring schema modifications.

Ensures that masked values remain consistent across all related tables and databases within an ecosystem. If a patient ID P-88421 is masked to X-33719 in the primary table, every foreign key reference across encounters, lab results, and billing records receives the identical substitution. This preserves critical relational joins for testing and analytics while preventing cross-table re-identification attacks that exploit inconsistent masking patterns.

Offers two distinct strategies based on use case requirements:

• Deterministic masking: The same input always produces the same masked output, enabling longitudinal analysis and cohort tracking across masked datasets
• Randomized masking: Each instance receives a unique substitution, providing stronger privacy guarantees when repeatability is unnecessary This dual-mode capability allows security architects to balance analytical fidelity against re-identification risk on a per-field basis.

Unlike encryption, which preserves a mathematical path back to the original value through decryption keys, data masking performs a one-way, lossy substitution. The original sensitive data is permanently replaced and cannot be recovered from the masked output. This property is essential for non-production environments—development, testing, and training—where encryption keys would represent an unacceptable security liability if compromised. Masked data eliminates the key management attack surface entirely.

Advanced masking workflows often combine data subsetting with masking to create smaller, representative datasets for development. Rather than masking an entire 500TB production database, a statistically representative 50GB subset is extracted and masked. Additionally, masking engines can inject synthetic data to fill edge cases or expand demographic distributions, ensuring test environments cover rare clinical scenarios without exposing real patient outliers.

Implements on-the-fly masking at the query layer, intercepting database requests and applying masking rules in real time based on user role and authorization level. A customer service representative might see only the last four digits of a credit card (****-****-****-1234), while a billing analyst with elevated privileges sees the full unmasked value. This approach eliminates static masked copies and ensures a single source of truth with granular, policy-driven data exposure.

A cryptographic method that encrypts sensitive data while preserving its original length and character format. This allows masked data to fit into existing database schemas without requiring structural changes to the application.

• Encrypts a 16-digit credit card into another 16-digit string
• Maintains data type integrity (e.g., strings remain strings)
• Ideal for legacy systems that cannot accept schema modifications
• Distinct from tokenization, which replaces data with a non-reversible surrogate

A data protection technique that replaces direct identifiers (e.g., name, MRN) with artificial pseudonyms. Unlike anonymization, pseudonymization is reversible under controlled conditions if the mapping table is retained.

• Enables re-identification for clinical follow-up or longitudinal studies
• Required under GDPR Article 4(5) as a technical safeguard
• The mapping table must be stored separately and secured
• Often confused with anonymization, which is irreversible by design

A non-reversible substitution process that replaces sensitive data elements with a non-sensitive equivalent called a token. The token has no extrinsic or exploitable meaning and cannot be mathematically reversed to the original value.

• Tokens are generated randomly or via a vault-based lookup
• Original data is stored in a secure, isolated token vault
• Commonly used for payment card data (PCI DSS compliance)
• Differs from encryption, which is reversible with the correct key

A privacy model ensuring that an individual's released data cannot be distinguished from at least k-1 other individuals whose data also appears in the release. This prevents identity disclosure by grouping individuals into equivalence classes.

• Quasi-identifiers (e.g., ZIP code, age, gender) are generalized or suppressed
• A higher k value provides stronger privacy but reduces data utility
• Vulnerable to homogeneity and background knowledge attacks
• Foundational concept formalized by Latanya Sweeney in 2002

A mathematical framework that provides a provable guarantee of privacy by injecting calibrated statistical noise into query results. The presence or absence of any single individual in the dataset becomes statistically indistinguishable.

• Governed by the privacy loss parameter epsilon (ε) — lower values mean stronger privacy
• Used by the U.S. Census Bureau for the 2020 decennial census
• Immune to linkage attacks because the output is randomized
• Achieved via mechanisms like the Laplace or Gaussian noise addition

A de-identification technique that systematically offsets all dates in a patient record by a consistent, random interval. This preserves temporal relationships (e.g., time between diagnosis and treatment) while obscuring actual calendar dates.

• A single random shift value is applied to all dates for one patient
• Different patients receive different random shift intervals
• Preserves clinical timelines for research and cohort analysis
• Must account for shifted dates that fall into impossible ranges (e.g., future dates)