I'll soon be working on upgrading a system which contains a MYSQL server and redis server on AWS
It works by querying two entire tables decrypting all of the contents and then putting the result in redis, the application then queries redis from then on to retrieve results.
The problem is everytime we clear redis all our sites grind to a halt as maybe as much as 20 separate things per user, per site are decrypted at runtime in PHP, some of these things are not even things we're that concerned about from a data privacy point of view like whether they are "active" or not, but some definitely feel like they are address, and some it's hard to figure out like their name
Because the other problem we have with this setup is that we cannot query our users or sort our users by name in SQL we have to start doing that by "querying" redis and then doing SQL like operations in PHP and it can get really ugly performance wise.
I've been looking at mariaDB's encryption at rest feature it would drastically sort out some of our architecture problems from an ease of use and performance point of view, if encryption was transparent in the database, but on the other hand it would be less secure than application level encryption
My question is what obilgations do we have as a company in the UK when it comes to encryption of healthcare related data and is my idea of encryption at rest enough? Are there some specific things about patients that definitely need to be encrypted? (Maybe we could do a hybrid approach?)
Is there a third approach I haven't thought about?