For this type of application you need to think about who should be allowed to access the data. With medical information I think it sould be restricted to the user who entered it and anyone they gave permission to view it.
In order to prevent the DBA from viewing the data you will have to encrypt it using a code that the DBA does not have access to.
You also need to encrypt the information in a way that the application programmer can't access it either. There's no point in encrypting the information from the DBA if a programmer can log in as any user.
You also don't want to encrypt all the data with the same code. The software might have a bug that shows one user the information of another. So it would probably be best to encrypt each users data using a code specific to that user.
It is important to note that you need to encrypt more than just the medical information; as an end user I wouldn't want your DBA even knowing I have a medical condition, let alone what it is. So you'll need to also encrypt any personally identifying information about the user. This includes such things as:
- date of birth
- email address