Need Help: Implementing Dynamic Masking for PHI Data in Power BI

Hi Everyone,

Background:

1. We have 60 report users, out of which 34 need access to PHI (Protected Health Information) data. Our environment includes 150 reports with multiple tabs, totaling approximately 450 instances where PHI is displayed.
2. At the database level (SQL Server), we’ve implemented column-level encryption. Only privileged users, defined in an Access Matrix table and with a valid certificate & key, can access decrypted data.
3. We are using Power BI's semantic model, pulling data from the SQL data warehouse into the Power BI data model (import mode). This ensures the reports pull data from the model rather than via "Direct Query."
4. While column-level encryption works well in SQL, we’ve observed that Power BI doesn’t support dynamic decryption of data based on the logged-in user. To address this, we decided to explore dynamic data masking in Power BI.
5. To achieve this, we’ve loaded decrypted data into the Power BI data model alongside the Access Matrix table.

Our Goal:
We want to dynamically show either masked or unmasked data in reports based on the logged-in user.

What We’ve Tried:
We attempted to use DAX with the USERNAME() function to dynamically check access rights against the Access Matrix table and mask data as needed. However, we ran into performance issues when dealing with large datasets and transactional-level details.

Questions:

1. Is there a way to dynamically decrypt data in Power BI based on the logged-in user?
2. If decryption isn’t feasible, what’s the best approach to implement efficient data masking in Power BI while ensuring performance scalability?

We’d appreciate any guidance, examples, or alternative approaches to solve this issue!

Thank you in advance!