I can't give you the full answer, but the short version that the lawyer at my previous hospital gave me was:
SSL will protect the data that is being transferred, however, anything that is cached to the SD card/Hard Drive is not encrypted...
So, when looking at this application, you will also have to encrypt what is stored on the phone by the app. If you have ever plugged an iPhone into your computer (or a friends), you have access to the full set of storage (including the OS), which means anything cached is available if the phone is lost.
I would look carefully at encrypting at least any PKI, PHI or PII that your program provides to the device.
The problem is that even if the program doesn't store data, the web interface can cache data going to and from the device. This is the part that could cause you problems.