See the comments about Schneier's new book http://news.ycombinator.com/item?id=1113641 http://news.ycombinator.com/item?id=1113641 Given that you are using a t

See the comments about Schneier's new book http://news.ycombinator.com/item?id=1113641 http://news.ycombinator.com/item?id=1113641 Given that you are using a tool stack that, well, has historically had a large number of security issues and that is difficult to get clarity on be cautious. It is possible to build capable and relatively secure systems using php but it takes a correspondingly greater effort to do so. You will want to pay special attention to the global php settings (if you turn on register_globals even in development you deserve to get sued for malpractice) and you will want to understand the different layers of encryption that support your application. You also need to engineer your applications workflow with an eye towards separating out different kinds of access. A patient filling out a form should not be able to access any other patient records. A doctor or clinical assistant should be able to view only those records their role requires; any patient record access should be recorded in an audit log that is not accessible to any user directly. Also, drop mysql for postgres; php support for postgres is very good and postgres supports in database public key encryption which you will want.