Transcoder needs to be able to parse and filter the XML but should not have access to sensitive data. Invoice's encrypted nodes encrypted for different organizations. Each record consists of the patient's name, address, diagnosis, and history. Doctors are allowed to see the entire patient record, and update the diagnosis and history.
Administration can see only the patient's name and address, and only update the address.
Researchers can see only the history and diagnosis. Cannot update any part of the record. Elements are encrypted with keys bound to those with authority to see the element's contents. Parse the XML fragment into a DOM node list. So, if one or more attributes of an element need to be encrypted, an EncryptedDataManifest attribute pointing to a list of encrypted nodes is added to that element.