I am trying to build an open-source EHR system with a database to store patients, doctors, and hospitals' information. I can design the database and build the actual system with the basic security in place such as user authentication, password encryption, sending data over HTTPS. However, this is where I hit a road-block. I understand the importance of protecting all information when it comes to medical software but I am not sure where to start with security. One simple example is if I have a database with the patients' personal information, do I have to encrypt all this information before storing it in the database? Do I need end-to-end encryption?
How do I go about ensuring the patient records are separate and can't be linked to the patient? Is this possible? If I were to use a MySQL database, for example, I would have a patient table and a records table, and link the Patient ID to the records table to create a relation. Would that be considered insecure?
I am quite lost because there is so much information out there but I have no idea where and what to look for. I would really appreciate if someone can give me some directions as to what to look for and maybe some more information which would help (anything from app security to legal, etc)