If all you need is file sharing, you don't need the Mac Server app.
I am more interested in Security: What country are you located in?
No matter where you are, you should appropriately safeguard your patient data. In the US, there are HIPPA guidelines and laws to follow. So whatever you do, make sure your software vendor supports your environment, and that you can properly secure the customer data.
By itself, without some deeper knowledge of how to secure your data, the Mac mini would be easy to steal and then they'd have access to the data. So you should apply both physical as well as data security techniques to protect the data.
For example (btw, I am not a security professional, my response will elicit a lot of debate here, and you should listen to it all and seek a professional if you aren't capable of deciphering it yourself):
1) Lock the Mini to the desk. A cable lock is easy enough to cut through for a prepared person, but it will keep a janitor or a quick smash-and-grab from taking it.
2) Use a dual-disk mini, and use FileVault to lock the second disk. Keep all of your patient data on the encrypted disk, nothing on the boot disk.
3) Use strong passwords for logging into the Mini and your laptop.
4) Back everything up daily to an external encrypted device, and take that device off site with you every day. Potentially use 2 external devices for backup, both encrypted, locking one in an onsite safe and keeping the second off site.
5) Avoid using WiFi for access, use hard wired. If you must use WiFi, consider having the WiFi access outside your protected LAN, connect to WiFi, and then use a VPN to access the corporate LAN to get access to the mini.
There are a lot more things. Using the Mac as a server is the easy part. Doing it right in a medical environment is harder.
