Sorry to be blunt, but if you're asking such a broad question, I suspect you're not yet knowledgeable enough to be able to responsibly do a project like this.

encryption

Encryption of data in transit (i.e. HTTPS) is absolutely critical, but it is not enough to make your site secure, because there are all kinds of ways a hacker can get data besides just intercepting it on the wire.

whitelisting ip adresses

This is a good defense-in-depth measure, if you can deal with the usability tradeoff of having to manage the whitelist. It's not perfect and you shouldn't rely on it. In particular, it does very little to stop targeted XSS or CSRF attacks.

running it on railway

Using a trustworthy hosting provider is necessary, but again, far from sufficient. I don't have any particular opinion about Railway in general.

You've basically only talked about the security of your network and hosting infrastructure, but not the security of the software you're creating, which is a huge potential source of vulnerabilities. Take a look at the OWASP Top Ten and the more detailed list of attacks for a sampling of the kinds of things that can go wrong. You must be very diligent and careful to avoid all of these vulnerabilities if you want your system to be secure.

And bear in mind that to some extent, security depends on users. No matter how securely you make your webapp, it won't help if your users have keyloggers installed on their machines, or if they get tricked into typing their passwords into a phishing page.

Also, bear in mind that healthcare is often covered by regulations. For instance, in the United States, healthcare organizations (including their software) are covered by HIPAA which includes security and privacy rules. It's not enough to just say that your software is secure. You also need to have documented processes and technical security infrastructure to detect security breaches if they happen, so that you can comply with your legal obligation to notify the affected users.