We have a non-profit client who uses a Microsoft SQL Server Express database based medical EMR software. They aren't technically HIPAA bound because they are a free medical clinic but I still want to follow the HIPAA guidelines in case that ever changes.
Their EMR database is currently on a Windows Server 2003 box on SQL Server Express 2008 R2 that we are about to move a 2012 R2 box running SQL Server Express 2014. This new server hosts other SQL Server Express databases for other applications on the network as well as their file shares. The EMR database is only accessed by the desktop medical applications using unique logins. I already have bitlocker with TPM enabled on the server. They are on a domain so folder directory level security will be used, of course. What other recommendations do you have for securing the data inside the...