Question: I was wondering if there are any standards for encrypting sensitive data in Database which are compliant w/ SOX or HIPAA. Or does the Encrypt Function in SQLServer necessary?. or handle in Business logic.

Any ideas or links we have.

Answer: 
First, Google for HIPAA Compliance

Then, read articles like this one: <http://www.developer.com/java/ent/article.php/3301011/HIPAA-Security-Rule---What-Software-Developers-Should-Know.htm>

And this <http://www.hipaa.ihs.gov/index.cfm?module=compliance_packet>

Finally, talk to your company's legal counsel. Failure to properly safeguard PHI will cost your company millions when you lose a lawsuit because your entire HIPAA compliance strategy was based on responses on StackOverflow.
SQL Server 2008 cryptographic API is certified for Common Criteria compliance: [Common Criteria Certification](http://msdn.microsoft.com/en-us/library/bb153837.aspx).