Ah, HIPPA. Well, that's a case of having far too detailed requirements! 8)

But it does answer the question of how sensitive the data is. I'd have to agree that end-to-end encryption, as one component in an overall security architecture, is probably called for in this case.