Encrypting answers on a clinic intake form

Design storage for a chain of 25 physiotherapy clinics whose patients fill in an online intake form before their first visit: contact details, an insurance number, and answers about their medical history. About 1,500 forms are submitted a day. Front-desk staff need contact details for scheduling; only the treating clinician should read the medical answers; and the company's engineers and database administrators should not be able to read medical answers at all. Forms are kept for 7 years and then deleted, and the deletion has to reach database backups too. Describe how the sensitive fields are encrypted, who holds the keys, how access is checked and logged, and how deletion works.