 <ul> <li><p><strong>Shared hosting</strong>: check government requirements, I'm not in the health care field, but I'd be very surprised if there are no rules/laws governing storage of sensitive personal information. If credit cards/ecommerce has PCI DSS requirements, I would think health care data would have at least same level (likely stricter) data protection rules (e.g. <a href="http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html" rel="nofollow"><strong>HIPAA</strong></a>?)</p></li> <li><p>I don't know much about 1&amp;1, but "where" may also be an issue(?) - <strong>where</strong> are the servers (of 1&amp;1) physically located?</p></li> <li><p>yet another thought: instead of having salt/pwd generated by user (how long/secure should they be?) Perhaps look into <a href="http://technet.microsoft.com/en-us/library/bb510663%28v=sql.100%29.aspx" rel="nofollow">SQL server encryption options</a>, moving the job to SQL instead of users and/or code. </p></li> <li><p>Decide if data should be encrypted or hashed (storage/retrieval vs. lookup) - re: password = hashed, SSN - depends on usage I guess. <a href="http://technet.microsoft.com/en-us/library/ms174415%28v=sql.100%29.aspx" rel="nofollow">Hash can also be done in SQL Server</a>....</p></li> </ul>