Chapter 6: Security Architecture & Encryption

Building Fortress: Security for Mental Health Data

Privacy policies and legal compliance mean nothing if mental health data isn't adequately secured. A single breach can expose the most intimate details of patients' lives, causing psychological harm, discrimination, and erosion of trust in mental healthcare. This chapter explores security architectures, encryption strategies, and defense-in-depth approaches specifically tailored for protecting mental health information.

Security for mental health data requires layered defenses—encryption at rest and in transit, strong access controls, network segmentation, intrusion detection, and incident response capabilities. Each layer provides protection, and together they create resilient systems that can withstand both external attacks and insider threats.

Defense-in-Depth Architecture

Defense-in-depth means implementing multiple layers of security controls. If one layer fails, others provide backup protection. For mental health systems, this approach is essential given the high value and sensitivity of the data.

Layer	Controls	Purpose	Mental Health Specifics
Perimeter	Firewalls, DDoS protection, WAF	Prevent unauthorized network access	Protect telehealth platforms; prevent service disruption during crisis
Network	Network segmentation, IDS/IPS, VPNs	Contain breaches; monitor for attacks	Isolate psychotherapy notes database; separate research networks
Application	Input validation, authentication, session management	Prevent application-level attacks	Protect patient portals; secure therapy chat applications
Data	Encryption, tokenization, masking	Protect data even if other layers breached	Encrypt all mental health data; separate encryption for psychotherapy notes
Endpoint	EDR, mobile device management, secure workstations	Protect devices accessing data	Secure therapist laptops; protect teletherapy devices
Physical	Facility access control, surveillance	Prevent physical access to systems	Secure server rooms; protect backup tapes
People	Security awareness training, background checks	Reduce human error and insider threats	Mental health stigma training; need-to-know access

Mental Health System Architecture Example

// Secure Architecture for Mental Health EHR

class MentalHealthEHRArchitecture {
  
  // Multi-tier architecture with security at each layer
  architecture = {
    
    // Tier 1: Presentation / User Interface
    presentationLayer: {
      components: ['Patient Portal', 'Clinician Workstation', 'Mobile Apps'],
      security: {
        authentication: 'MFA_REQUIRED',
        sessionManagement: 'SHORT_TIMEOUTS', // 15 minutes for mental health
        inputValidation: 'STRICT',
        outputEncoding: 'XSS_PREVENTION',
        csp: 'CONTENT_SECURITY_POLICY_ENFORCED',
        https: 'TLS_1_3_ONLY'
      },
      mentalHealthFeatures: {
        discreteMode: true, // Hide sensitive info from shoulder surfing
        panicButton: true, // Quickly hide screen in crisis situations
        offlineMode: 'ENCRYPTED_LOCAL_STORAGE' // For therapy in areas with poor connectivity
      }
    },
    
    // Tier 2: Application / Business Logic
    applicationLayer: {
      components: [
        'Clinical Workflow Engine',
        'Consent Management System',
        'Psychotherapy Notes Module',
        'Research Data Export Service'
      ],
      security: {
        serviceAuthentication: 'MUTUAL_TLS',
        authorization: 'ROLE_BASED_ACCESS_CONTROL',
        apiGateway: 'RATE_LIMITING_AND_THREAT_DETECTION',
        secretsManagement: 'VAULT_INTEGRATION',
        logging: 'COMPREHENSIVE_AUDIT_LOGS'
      },
      dataFlowControls: {
        psychotherapyNotes: 'SEPARATE_SERVICE', // Isolated from other clinical data
        dataExport: 'REQUIRES_TWO_PERSON_RULE',
        bulkAccess: 'FLAGGED_FOR_REVIEW',
        crossBorderTransfer: 'BLOCKED_BY_DEFAULT'
      }
    },
    
    // Tier 3: Data / Storage
    dataLayer: {
      components: {
        primaryDatabase: {
          type: 'Encrypted PostgreSQL',
          encryption: 'AES_256_GCM',
          keyManagement: 'HSM_BACKED',
          backups: 'ENCRYPTED_OFFSITE',
          replication: 'ENCRYPTED_TLS'
        },
        psychotherapyNotesDB: {
          type: 'Separate Encrypted Database',
          encryption: 'AES_256_GCM_WITH_ADDITIONAL_KEY',
          access: 'RESTRICTED_TO_NOTE_CREATOR',
          backup: 'SEPARATE_BACKUP_SYSTEM',
          location: 'SEPARATE_SERVER'
        },
        documentStorage: {
          type: 'Encrypted Object Storage',
          encryption: 'SERVER_SIDE_WITH_CUSTOMER_KEYS',
          accessControl: 'IAM_POLICIES',
          versioning: 'ENABLED'
        }
      },
      security: {
        encryptionAtRest: 'ALL_DATA_ENCRYPTED',
        encryptionInTransit: 'TLS_1_3',
        keyRotation: 'ANNUAL',
        databaseFirewall: 'ENABLED',
        queryMonitoring: 'SQL_INJECTION_DETECTION'
      }
    },
    
    // Network Security
    networkSecurity: {
      segmentation: {
        dmz: 'Patient portal and public-facing services',
        appTier: 'Application servers',
        dataTier: 'Databases',
        managementTier: 'Admin and monitoring systems',
        researchTier: 'Isolated network for research data'
      },
      controls: {
        firewalls: 'ZERO_TRUST_MODEL',
        ids_ips: 'DEPLOYED_AT_ALL_BOUNDARIES',
        networkAccessControl: '802_1X',
        ddosProtection: 'CLOUD_BASED',
        vpn: 'REQUIRED_FOR_REMOTE_ACCESS'
      }
    }
  };
  
  // Security policy enforcement
  enforceSecurity(request: DataAccessRequest): AccessDecision {
    // Layer 1: Network check
    if (!this.isFromAuthorizedNetwork(request.sourceIP)) {
      return { denied: true, reason: 'Unauthorized network' };
    }
    
    // Layer 2: Authentication
    if (!this.isAuthenticated(request.user) || !this.hasMFA(request)) {
      return { denied: true, reason: 'Authentication required' };
    }
    
    // Layer 3: Authorization
    if (!this.isAuthorized(request.user, request.resource)) {
      return { denied: true, reason: 'Insufficient permissions' };
    }
    
    // Layer 4: Consent check
    if (!this.hasPatientConsent(request)) {
      return { denied: true, reason: 'Patient consent required' };
    }
    
    // Layer 5: Contextual access control
    if (this.isAnomalous(request)) {
      return { denied: true, reason: 'Anomalous access pattern flagged' };
    }
    
    // All layers passed - grant access with audit
    this.logAccess(request);
    return { granted: true };
  }
}

Encryption Strategies

Encryption is fundamental to mental health data security. However, not all encryption is created equal. Implementing encryption requires careful consideration of encryption algorithms, key management, and where encryption occurs in the data lifecycle.

Encryption at Rest

Mental health data at rest—stored in databases, file systems, backups—must be encrypted to protect against theft of physical media, unauthorized database access, and insider threats.

Approach	Description	Advantages	Considerations
Transparent Database Encryption (TDE)	Database encrypts all data files transparently	Easy to implement; no application changes	Keys often stored with database; doesn't protect from DB admin
Column-Level Encryption	Specific sensitive columns encrypted	Granular protection; can have different keys per column	Application must handle encryption/decryption; performance impact
Application-Level Encryption	Application encrypts before writing to database	Database sees only ciphertext; protects from DB admin	Searching encrypted data difficult; key management complex
File-System Encryption	Entire file system encrypted	Protects all files; operating system manages	Keys available when system booted; less granular
Hardware Security Module (HSM)	Cryptographic operations performed in tamper-resistant hardware	Highest security for keys; compliance friendly	Cost; complexity

// Application-Level Encryption for Mental Health Data

class MentalHealthDataEncryption {
  
  // Encrypt sensitive field before storing
  async encryptField(
    plaintext: string,
    fieldType: string,
    patientId: string
  ): Promise {
    
    // Get patient-specific encryption key
    const dataKey = await this.getDataEncryptionKey(patientId);
    
    // Use AES-256-GCM for authenticated encryption
    const iv = crypto.randomBytes(16); // Initialization vector
    const cipher = crypto.createCipheriv('aes-256-gcm', dataKey, iv);
    
    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
    encrypted += cipher.final('base64');
    
    // Get authentication tag
    const authTag = cipher.getAuthTag();
    
    return {
      ciphertext: encrypted,
      iv: iv.toString('base64'),
      authTag: authTag.toString('base64'),
      algorithm: 'AES-256-GCM',
      keyVersion: await this.getKeyVersion(patientId),
      encryptedAt: new Date()
    };
  }
  
  // Decrypt sensitive field when authorized
  async decryptField(
    encryptedField: EncryptedField,
    patientId: string
  ): Promise {
    
    // Verify authorization before decrypting
    if (!await this.isAuthorizedToDecrypt(patientId)) {
      throw new Error('Unauthorized decryption attempt');
    }
    
    // Get the right version of the key
    const dataKey = await this.getDataEncryptionKey(
      patientId,
      encryptedField.keyVersion
    );
    
    const iv = Buffer.from(encryptedField.iv, 'base64');
    const authTag = Buffer.from(encryptedField.authTag, 'base64');
    
    const decipher = crypto.createDecipheriv('aes-256-gcm', dataKey, iv);
    decipher.setAuthTag(authTag);
    
    let decrypted = decipher.update(encryptedField.ciphertext, 'base64', 'utf8');
    decrypted += decipher.final('utf8');
    
    // Log decryption for audit
    await this.logDecryption(patientId, encryptedField);
    
    return decrypted;
  }
  
  // Key management with key encryption keys (KEK)
  async getDataEncryptionKey(
    patientId: string,
    version?: number
  ): Promise {
    
    // Data keys are themselves encrypted with a key encryption key
    const encryptedDataKey = await this.keyStore.getEncryptedKey(
      patientId,
      version
    );
    
    // Decrypt the data key using KEK from HSM
    const kek = await this.hsm.getKeyEncryptionKey();
    const dataKey = await this.decrypt WithKEK(encryptedDataKey, kek);
    
    return dataKey;
  }
  
  // Separate encryption for psychotherapy notes
  async encryptPsychotherapyNote(
    noteContent: string,
    therapistId: string,
    patientId: string
  ): Promise {
    
    // Use a separate key hierarchy for psychotherapy notes
    const noteKey = await this.getPsychotherapyNoteKey(therapistId, patientId);
    
    // Double encryption for extra protection
    const firstEncryption = await this.encryptField(
      noteContent,
      'PSYCHOTHERAPY_NOTE',
      patientId
    );
    
    // Second layer with therapist-specific key
    const secondEncryption = await this.encryptWithTherapistKey(
      JSON.stringify(firstEncryption),
      therapistId
    );
    
    return {
      doubleEncrypted: secondEncryption,
      therapistId: therapistId,
      patientId: patientId,
      canDecrypt: [therapistId], // Only therapist can decrypt
      requiresSpecialAuthorization: true
    };
  }
}

Access Control and Authentication

Even with strong encryption, access controls determine who can access mental health data. Multi-factor authentication, role-based access control, and principle of least privilege are essential.

Role-Based Access Control (RBAC) for Mental Health

// Mental Health RBAC Implementation

interface MentalHealthRole {
  roleId: string;
  roleName: string;
  permissions: Permission[];
  dataAccessScope: AccessScope;
  constraints: AccessConstraint[];
}

const mentalHealthRoles: MentalHealthRole[] = [
  {
    roleId: 'PSYCHIATRIST',
    roleName: 'Psychiatrist',
    permissions: [
      'READ_PATIENT_DEMOGRAPHICS',
      'READ_MEDICAL_HISTORY',
      'READ_MENTAL_HEALTH_DIAGNOSES',
      'WRITE_DIAGNOSES',
      'PRESCRIBE_MEDICATIONS',
      'READ_THERAPY_SUMMARIES', // Can read summaries but not psychotherapy notes
      'WRITE_CLINICAL_NOTES'
    ],
    dataAccessScope: 'ASSIGNED_PATIENTS_ONLY',
    constraints: [
      'CANNOT_ACCESS_PSYCHOTHERAPY_NOTES',
      'REQUIRES_PATIENT_CONSENT_FOR_RESEARCH_USE'
    ]
  },
  {
    roleId: 'THERAPIST',
    roleName: 'Licensed Therapist',
    permissions: [
      'READ_PATIENT_DEMOGRAPHICS',
      'READ_MENTAL_HEALTH_DIAGNOSES',
      'READ_ASSIGNED_PSYCHOTHERAPY_NOTES', // Only own notes
      'WRITE_PSYCHOTHERAPY_NOTES',
      'WRITE_CLINICAL_NOTES',
      'MANAGE_TREATMENT_PLAN'
    ],
    dataAccessScope: 'ASSIGNED_PATIENTS_ONLY',
    constraints: [
      'OWN_PSYCHOTHERAPY_NOTES_ONLY',
      'CANNOT_ACCESS_OTHER_THERAPIST_NOTES',
      'REQUIRES_MFA'
    ]
  },
  {
    roleId: 'CASE_MANAGER',
    roleName: 'Case Manager',
    permissions: [
      'READ_PATIENT_DEMOGRAPHICS',
      'READ_TREATMENT_PLAN',
      'READ_DIAGNOSIS_SUMMARY', // High-level only
      'COORDINATE_CARE',
      'ACCESS_COMMUNITY_RESOURCES'
    ],
    dataAccessScope: 'ASSIGNED_PATIENTS_ONLY',
    constraints: [
      'NO_PSYCHOTHERAPY_NOTES',
      'NO_DETAILED_CLINICAL_NOTES',
      'SUMMARY_LEVEL_ACCESS_ONLY'
    ]
  },
  {
    roleId: 'RESEARCHER',
    roleName: 'Clinical Researcher',
    permissions: [
      'READ_DEIDENTIFIED_DATA',
      'EXPORT_ANONYMIZED_DATA',
      'RUN_AGGREGATE_QUERIES'
    ],
    dataAccessScope: 'RESEARCH_DATASET_ONLY',
    constraints: [
      'NO_IDENTIFIED_DATA',
      'IRB_APPROVAL_REQUIRED',
      'CANNOT_ATTEMPT_REIDENTIFICATION',
      'EXPORT_LOGGED_AND_REVIEWED'
    ]
  },
  {
    roleId: 'BILLING_STAFF',
    roleName: 'Billing Specialist',
    permissions: [
      'READ_PATIENT_DEMOGRAPHICS',
      'READ_INSURANCE_INFO',
      'READ_DIAGNOSIS_CODES', // For billing only
      'READ_PROCEDURE_CODES',
      'SUBMIT_CLAIMS'
    ],
    dataAccessScope: 'BILLING_DATA_ONLY',
    constraints: [
      'NO_CLINICAL_NOTES',
      'NO_PSYCHOTHERAPY_NOTES',
      'MINIMUM_NECESSARY_FOR_BILLING'
    ]
  }
];

class AccessControlEngine {
  
  // Check if user can perform action on resource
  async checkAccess(
    user: User,
    action: string,
    resource: Resource
  ): Promise {
    
    // Get user's roles
    const userRoles = await this.getUserRoles(user.id);
    
    // Check each role
    for (const role of userRoles) {
      // Does role have the required permission?
      if (!role.permissions.includes(action)) {
        continue; // Try next role
      }
      
      // Check data access scope
      if (!this.checkScope(user, resource, role.dataAccessScope)) {
        continue;
      }
      
      // Check constraints
      const constraintViolation = await this.checkConstraints(
        user,
        resource,
        role.constraints
      );
      
      if (constraintViolation) {
        return {
          granted: false,
          reason: `Constraint violation: ${constraintViolation}`
        };
      }
      
      // Access granted
      return {
        granted: true,
        role: role.roleName,
        conditions: this.extractConditions(role)
      };
    }
    
    // No role granted access
    return {
      granted: false,
      reason: 'User does not have required permissions'
    };
  }
  
  // Special handling for psychotherapy notes
  checkPsychotherapyNoteAccess(
    user: User,
    note: PsychotherapyNote
  ): AccessDecision {
    
    // Only the creating therapist can access without authorization
    if (note.createdBy === user.id) {
      return { granted: true, reason: 'Note creator' };
    }
    
    // Check for specific patient authorization
    const authorization = this.getPatientAuthorization(
      note.patientId,
      user.id
    );
    
    if (!authorization || !authorization.includesPsychotherapyNotes) {
      return {
        granted: false,
        reason: 'Specific authorization for psychotherapy notes required'
      };
    }
    
    return { granted: true, reason: 'Patient authorization' };
  }
}

Key Takeaways

Defense-in-depth architecture provides multiple layers of security, ensuring that if one layer fails, others provide protection
Encryption at rest protects mental health data from theft, unauthorized access, and insider threats; application-level encryption provides strongest protection
Encryption in transit using TLS 1.3 protects mental health data during transmission, critical for telehealth and remote access
Role-based access control (RBAC) ensures users have only the minimum permissions necessary for their role
Psychotherapy notes require special security measures including separate encryption, restricted access, and enhanced audit logging
Multi-factor authentication (MFA) should be required for all access to mental health data, especially for remote access and administrative functions
Security architecture must balance protection with usability—overly restrictive security can impede clinical care and patient safety

Review Questions

Explain the defense-in-depth security model. Why is it particularly important for mental health data?
Compare and contrast different encryption-at-rest approaches (TDE, column-level, application-level). Which provides the strongest protection and why?
What is the purpose of using a key encryption key (KEK) to encrypt data encryption keys (DEK)? How does this improve security?
Describe how role-based access control should be implemented for a mental health system. Provide examples of appropriate roles and permissions.
Why do psychotherapy notes require separate security measures beyond those applied to other clinical data?
Explain how multi-factor authentication enhances security for mental health systems. What factors should be used?
Design a secure architecture for a teletherapy platform that allows encrypted video sessions, secure messaging, and storage of session notes. What security controls would you implement at each layer?
How can organizations balance security requirements with the need for timely access to mental health data in emergency situations?

弘益人間 · Benefit All Humanity

Security is not just about technology—it's about trust. When we implement robust security for mental health data, we demonstrate our commitment to protecting those who have entrusted us with their most private thoughts and struggles. This trust is the foundation upon which effective mental healthcare is built.

The principle of 弘익人間 reminds us that security benefits all humanity. By protecting individual mental health data, we protect the societal trust in mental healthcare systems. When people trust that their information will be secure, they are more likely to seek help, engage authentically in treatment, and achieve better outcomes. Thus, security serves not just individual privacy, but the collective good.