2
First of all: stop developing until you can really understand encryption, privacy, and the laws regarding medical data. If because of financial reasons you cannot have an expert to inspect and certify your solution, for financial reasons you should not develop it. The money spent on having a specialist helping you design and test is a few orders of magnitude ...
2
I'm not a cryptographic expert but here is my point of view.
Both methods you talk about are storing the keys offline. Secrets stored in smart cards cannot be read. The goal of a smart card is to keep the private key out of the computer. You can communicate with your smart card to do cryptographic operation but you can't extract the private key.
So your ...
Only top voted, non community-wiki answers of a minimum length are eligible
