Implementing HAPI FHIR Data Encryption at Rest: Using Percona PostgreSQL and pg_tde

Details

HAPI FHIR is an open-source implementation based on the HL7 FHIR standard, forming a foundation for healthcare interoperability. This article focuses on enhancing data security within this system by addressing 'data at rest' encryption. The specific technical approach detailed is the use of Percona Distribution for PostgreSQL and the `pg_tde` extension (Transparent Data Encryption). The `pg_tde` extension enables table-level encryption, providing transparent data protection without requiring application changes. The implementation process includes enabling TDE via Docker environment variables, installing the extension in the database, and applying encryption to specific HAPI FHIR tables (e.g., `hfj_resource`) using `ALTER TABLE`. This methodology provides technical insights for comprehensive data protection—covering not only 'data in transit' security measures like OpenID Connect or OAuth 2.0, but also the critical layer of 'data at rest.' This is highly relevant to handling sensitive patient data within Japanese healthcare IT systems, offering a practical guide for developers and engineers.