Answers.Body: <p>You should be able to use the functions in:</p>
  
  <p>CRM/Utils/Crypt.php </p>
  
  <p>to do symmetric encryption/decryption of the fields. Password related fields in the CiviCRM db are encrypted. As Lesley mentions, there are two aspects to this problem. Encrypting data, and restricting access to the data to a certain class of users</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-18T03:44:44.820Z
Answers.LastActivityDate: 2015-04-18T03:44:44.820Z
Answers.UserDisplayName: Donald Lobo
Answers.Body: <p>Do you want just one field encrypted or a group of fields (if you're dealing w/HIPAA data, probably it is more than one, right?) Create custom fields where the 'Type' is, say, 'HIPAA' (you can create this subtype by subtyping your basic object, whether it is Activities, Campaigns, or Contacts).  From there, you'd need to add a hook/code to encrypt fields where the Type == HIPAA.. You'd need to also determine which user type(s) (Admin?) should be able to see unencrypted values and handle that.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-17T22:39:12.680Z
Answers.LastActivityDate: 2015-04-17T22:39:12.680Z
Answers.UserDisplayName: Lesley Evensen
Answers.Body: <p>We were recently asked to 'Encrypt one CiviCRM custom field' for one of our clients who uses Webform CiviCRM module as a GUI to view/edit/add custom field values to CiviCRM for their clients. </p>
  
  <p>I ended up leveraging Drupal Encrypt module to not just encrypt the values stored on the Drupal side (in the Webform Submission) but also to encrypt the values stored on the CiviCRM side. </p>
  
  <p>Using Webform CiviCRM module to handle view/edit/add custom field values means a variety of Drupal access permissions are available to control which user can see what. </p>
  
  <p><strong>Example:</strong> 
  a:6:{s:4:"text";s:128:"JA/qWZ50z61GS7hA3mvXSyKSHjoOdxAnr+LttK8/ZIpLNOl1yTBY6+xPN0B9T08wqdat5Rvdbois1EVXrPXYA7OZO6ja08hW8NjNk1Fsn47TBJuWGWKpEC+k0cCjYAiV";s:6:"method";s:14:"mcrypt_aes_cbc";s:12:"key_provider";s:15:"drupal_variable";s:7:"options";a:1:{s:6:"base64";b:1;}s:15:"method_settings";s:0:"";s:17:"provider_settings";a:1:{s:6:"method";s:13:"base64_decode";}}</p>
  
  <p>If you think this may be useful, feel free to give it a try and let me know what you think. The code lives here -> <a href="https://github.com/KarinG/webform_deur_encrypt" rel="nofollow noreferrer">https://github.com/KarinG/webform_deur_encrypt</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-08-27T14:10:15.033Z
Answers.LastActivityDate: 2019-08-27T14:43:04.447Z
Answers.LastEditDate: 2019-08-27T14:43:04.447Z
Answers.UserDisplayName: KarinG - Semper IT
Body: <p>To protect sensitive data - such as HIPAA info</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-17T20:48:54.590Z
Comments.Text: Not currently.  This wouldn't be hard to implement - but the process by which you decide who can decrypt it would get very hairy.  Can you edit your question to explain how you want to determine who can view decrypted data?
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-24T01:36:25.857Z
Comments.Text: For starters, the purpose would be to encrypt fields when stored so an unauthorized access directly to the database would not be able to see the encrypted database.  As to Civi users, I assume we would use existing permissions to restrict access.
Comments.UserDisplayName: Dave T
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-24T04:35:06.377Z
Comments.Text: You can restrict access by custom field group, not custom field - but you can have a single field in a group.  So you're suggesting that any custom field groups that are subject to an ACL should be encrypted at rest, and accessible to folks in the ACL group?  Not currently an option, but an excellent suggestion for improvement.
Comments.UserDisplayName: Jon G - Megaphone Tech
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-25T22:50:15.733Z
Comments.Text: Yes, that would work.   I am not a coder but is it safe to say that Lobo's recommendation could be employed with the custom field group ACL solution?
Comments.UserDisplayName: Dave T
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2015-04-26T01:08:21.350Z
Comments.Text: I believe so, yes.
Comments.UserDisplayName: Jon G - Megaphone Tech
Tags: <sql><security>
Title: Is there a way to encrypt a single field in Civi database?
ThreadText: # Is there a way to encrypt a single field in Civi database?
  
  (Asked by: username_0 on 2015-04-17)
  
  To protect sensitive data - such as HIPAA info
  
  **Tags:** sql, security
  
  > **Comments:**
  > **username_1**: Not currently.  This wouldn't be hard to implement - but the process by which you decide who can decrypt it would get very hairy.  Can you edit your question to explain how you want to determine who can view decrypted data?  
  > **username_0**: For starters, the purpose would be to encrypt fields when stored so an unauthorized access directly to the database would not be able to see the encrypted database.  As to Civi users, I assume we would use existing permissions to restrict access.  
  > **username_1**: You can restrict access by custom field group, not custom field - but you can have a single field in a group.  So you're suggesting that any custom field groups that are subject to an ACL should be encrypted at rest, and accessible to folks in the ACL group?  Not currently an option, but an excellent suggestion for improvement.  
  > **username_0**: Yes, that would work.   I am not a coder but is it safe to say that Lobo's recommendation could be employed with the custom field group ACL solution?  
  > **username_1**: I believe so, yes.  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2015-04-18. Score: 3
  
  You should be able to use the functions in:
  
  CRM/Utils/Crypt.php
  
  to do symmetric encryption/decryption of the fields. Password related fields in the CiviCRM db are encrypted. As Lesley mentions, there are two aspects to this problem. Encrypting data, and restricting access to the data to a certain class of users
  
  
  ---
  
  ### Answer by username_3 on 2015-04-17. Score: 2
  
  Do you want just one field encrypted or a group of fields (if you're dealing w/HIPAA data, probably it is more than one, right?) Create custom fields where the 'Type' is, say, 'HIPAA' (you can create this subtype by subtyping your basic object, whether it is Activities, Campaigns, or Contacts). From there, you'd need to add a hook/code to encrypt fields where the Type == HIPAA.. You'd need to also determine which user type(s) (Admin?) should be able to see unencrypted values and handle that.
  
  
  ---
  
  ### Answer by username_4 on 2019-08-27. Score: 2
  
  We were recently asked to 'Encrypt one CiviCRM custom field' for one of our clients who uses Webform CiviCRM module as a GUI to view/edit/add custom field values to CiviCRM for their clients.
  
  I ended up leveraging Drupal Encrypt module to not just encrypt the values stored on the Drupal side (in the Webform Submission) but also to encrypt the values stored on the CiviCRM side.
  
  Using Webform CiviCRM module to handle view/edit/add custom field values means a variety of Drupal access permissions are available to control which user can see what.
  
  **Example:**
  a:6:{s:4:"text";s:128:"JA/qWZ50z61GS7hA3mvXSyKSHjoOdxAnr+LttK8/ZIpLNOl1yTBY6+xPN0B9T08wqdat5Rvdbois1EVXrPXYA7OZO6ja08hW8NjNk1Fsn47TBJuWGWKpEC+k0cCjYAiV";s:6:"method";s:14:"mcrypt\_aes\_cbc";s:12:"key\_provider";s:15:"drupal\_variable";s:7:"options";a:1:{s:6:"base64";b:1;}s:15:"method\_settings";s:0:"";s:17:"provider\_settings";a:1:{s:6:"method";s:13:"base64\_decode";}}
  
  If you think this may be useful, feel free to give it a try and let me know what you think. The code lives here -> <https://github.com/KarinG/webform_deur_encrypt>
  
  
  ---
  
  