department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:
https://depo-platform-documentation.scrollhelp.site/index.html
282 stars 203 forks source link

Ensure claim information is masked in logs and URIs #93791

Open kjduensing opened 3 weeks ago

kjduensing commented 3 weeks ago

Context

Claim numbers TC00000001234 are certainly PII, but because no one, even at OCTO levels, understands where the PII boundaries are, and also because the stakes are high if we're wrong about something NOT being PII, we need to strip any potentially PII & PII-adjacent information from any logging systems.

Details

This has been done before in vaos for ICNs and in appointments for VistA IDs.

We need to do the same for the opaque claim UUIDs.

Acceptance Criteria

ayush-chak commented 3 weeks ago

Hey team! Please add your planning poker estimate with Zenhub @hinzed1127 @kjduensing @liztownd

hinzed1127 commented 1 week ago

Got a couple PRs up in draft. The vets-api one probably needs a few updates after some review discussion. The vets-website one is pretty limited. If the vets-api approach is valid, that one should be good to get promoted out of draft pretty quickly.

vets-api PR: https://github.com/department-of-veterans-affairs/vets-api/pull/18863 vets-website PR: https://github.com/department-of-veterans-affairs/vets-website/pull/32380