What is considered "best practice" for encrypting certain sensitive or personally identifiable data in a SQL database (under PCI, HIPAA, or other applicable compliance standards)?

There are many questions here regarding individual aspects of a solution, but I have not seen any that discuss the approach at a high level. 
After looking around for quite some time, I came up with the following:

* Use CryptoAPI and Rijndael
* Generate IV and store it with the encrypted data
* Use DPAPI (Machine scope) to "protect" the symmetric key
* Store the symmetric key in the registry or a file or the database, split the key and store parts in multiple places for added protection
* do not decrypt the data unless it is really needed, i.e. not upon read from the database. Instead, hold cipher text in memory.

Is this adequate? Outdated? Audit-safe? Reckless?