Co-sign with @Xander and @Michael Hampton.
Those source code encryption schemes all rely on... a private key. So that doesn't solve your problem, it just moves the problem somewhere else.
Obtaining the key from a separate server has the same problem: you need to authenticate to that other server, and the authentication credentials must be stored somewhere on the shared host. So again, all you've done is moved the problem around a bit.
You could store the key in the database itself or in memory -- neither of which should be readable by other users on your shared host unless they exploit some vulnerability to escalate privileges. In the case of in-memory storage, this would require you to connect to the application whenever it is restarted and provide the key remotely, which would require a secure connection.
I have no idea what the laws are like in your country [and IANAL], but from a purely ethical point of view, I would never host personal health information on an unaccredited shared hosting facility. You might be able to pull it off; you might even be able to comply with local laws and regulations, but it would still never be very safe.
You've also stumbled upon a much bigger problem in general: even the best encryption is only as strong as the safety of the private keys involved. Even in a dedicated hosting environment, a vulnerability in your application may enable an attacker to recover the key, and you are also vulnerable to anybody who has physical access to the server itself, such as any of the employees of your hosting provider.
Even if the key is perfectly secure, you still need to think about how your application handles the data after it's been decrypted. Do your access controls ensure that users only see information they are authorized to see? Do your security controls prevent or mitigate the risk of an attacker hijacking an authorized session and then using it for unauthorized purposes?
The answers to these questions depend, in part, on the legal requirements where are you are operating.
- Presumably the other server is not on a shared host, otherwise what benefit does this separation have? But if you have access to a non-shared host, why are you hosting your application on a shared host in the first place?
- Privilege escalation seems out of scope for the question you're asking.