First off, change the directory name. I suggest coming up with a fairly long (25 letters or so) directory name. Inside, put the .htaccess. This way, not only do people have to know the directory name, they have to know the access codes.
If you are doing this through something like a hospital, I would recommend removing any outside connection to this computer, so nothing can be done except from inside the LAN.
Hope this helps. There are probably more secure ways, too, so don't just run off and do exactly as I say. I'm sure you'll get some more replies.
