Ominus' answer addresses your first question. The answer to the second question may require more details about your application.
Another approach with even greater security if the patients must access the database could be to have a separate database for each user. In this approach you might use a framework that provides multi-tenant, multi-database functionality. The problem however is that if you have separate application users and separate database users, synchronizing these users will be incredibly difficult.
I would guess that patients don't need to access your database though. If they do need to, it might be most secure to have a key per user.
In addition to legal or contractual requirements, some other reasons I can think of to have separate databases are: customer's perception of increased security making sales easier, worries about encryption being broken, and worries about (the) key(s) being compromised.
Regarding the part of Briddmus' answer where he states "that you need to encrypt more than just the medical information": this only holds if everyone in the database has a medical condition. (I would guess this is the case).
Note: parts of this answer would be better suited as comments but I don't yet have sufficient rep to post comments here.