I'm developing a HIPAA compliant site using Drupal 7 that collects some personal sensitive data from users, and this data should be protected. I've already encrypted the data before it's stored in the database. However, the raw plain-text data remains (temporarily) in the "form_cache" table until the form cache expires (+6 hrs set from the Drupal 7 core).
If a parasitic villain were to somehow swipe a copy of the database, he wouldn't be able to read most of the data, but whomever had recently filled in a form would be compromised.
Has anyone found a relatively painless solution for keeping sensitive form field data out of the "form_cache" database table?