I'll assume you're in the U.S., and are a Covered Entity, since you refer to HIPAA and are storing patient information.
First off, note that the HITECH act and related federal guidance put significantly more detailed guidance on the table; much more than the "reasonable effort" HIPAA guidance, and involving much more serious action in the case of a breach.
If you can afford it, get a consultant who specializes in the area. You'll need a lawyer who knows the area whether you have a consultant or not.
For official HIPAA/HITECH guidance, as a bare minimum, start with HHS (Health and Human Services), NIST (National Institute of Standards and Technology), and FIPS (Federal Information Processing Standards) - I've outlined a few high points below - this list is in no way complete nor comprehensive - it's merely a starting point!
HHS.gov Health Information Privacy
HHS.gov Security Rule Guidance Material
HHS.gov Understanding Health Information Privacy
HHS.gov Breach Notification Rule - this is one of the most critical pages, as it links to important Federal Register articles.
Other NIST Special Publications of interest include, but are not limited to:
FIPS 140-2 Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules is specifically mentioned in 74 FR 19006.
- Note that DSA/ElGamal GPG and PGP keys do not qualify as FIPS 140-2 compliant - not only is ElGamal not listed, the DSA keys are almost always 1024 bit, which is too short per NIST SP 800-131A (above).