It's hard to design systems that don't keep sensitive data in readable formats. Protecting filenames could be done by encrypting with a salted hash of the user

It's hard to design systems that don't keep sensitive data in readable formats. Protecting filenames could be done by encrypting with a salted hash of the user password. Doing this correctly while allowing password changes is really tricky. Can you recommend a good set of guidelines for getting it right?