Is this protocol for masking DB ids sound?
What you are looking for is a randomized authenticated cipher of short bit strings, 64 bits long.  You seem to be willing to accept between 64 and 256 bits of ciphertext expansion.


With an $r$-bit randomization string, the probability of a collision after $n$ ciphertexts—which would, at the very least, reveal equality of masked ids—is at best bounded by about $n^2/2^r$.
With $t$-bit authentication expansion, the probability of forgery after $f$ attempts is at best bounded by about $f/2^t$.


You could use any randomized authenticated cipher you like, e.g. NaCl crypto_secretbox_xsalsa20poly1305, which has a 192-bit nonce and a 128-bit authentication tag; if you use a 128-bit nonce chosen uniformly at random (padded with zeros up to 192 bits), you're safe as long as you limit yourself to well below $2^{64}$ ids, e.g. limit yourself to a billion ids.  You could use AES-GCM, but the limits are even smaller because the nonce is 96 bits, so you need to limit yourself to well below $2^{48}$ ids.  A nonce collision here is catastrophic, of course.

If you want to build it out of AES and SHA-256, you could just use AES-CBC with encrypt-then-MAC and the 128-bit truncation of HMAC-SHA256.  Since the input is fixed-length, there's no need for padding; effectively, it would just be $$E_{k_1,k_2}(\rho, m) := c \mathbin\| \operatorname{HMAC-SHA256-128}_{k_2}(c), \quad \text{where} \quad c = \rho \mathbin\| \operatorname{AES}_{k_1}(\rho \oplus m).$$  In the case of a collision in $\rho$, this still leaks only equality of masked ids.  Obviously, you can derive $k_1$ and $k_2$ from a single 32-byte master key $k$ with HKDF-SHA256.

Here's a very simple approach that uses a single call to AES with a single key, to encrypt a 64-bit id $m$ with 64-bit randomization $\rho$ under key $k$: $$E_k(\rho, m) := \rho \mathbin\| \operatorname{AES}_k(\rho \mathbin\| m).$$  Here $r = t = 64$, so we're using 192 bits to encrypt a 64-bit id.  Let $\pi$ be a uniform random permutation; for any forgery attempts $\rho_1 \mathbin\| c_1, \dots, \rho_f \mathbin\| c_f$, the probability that there is any $i$ such that $\pi^{-1}_{64}(c_i) = \rho_i$ is bounded by $f/2^{64}$, where $\pi^{-1}_{64}(c_i)$ is the first 64 bits of $\pi^{-1}(c_i)$.  Consequently, the distinguisher and forgery advantage of any algorithm against $E_k$ is bounded by $(n^2 + f)/2^{64} + \varepsilon$ where $\varepsilon$ is the best advantage at AES from a uniform random permutation.  If you mask a million ids and your bandwidth limits the adversary to a trillion forgery attempts, the odds are less than one in eight thousand that the adversary will win.  Even if there is a collision in $\rho$, again this only leaks equality of masked ids, although forgery might be a bigger issue.

What about the scheme you described?  It's more complicated than necessary: you could do away with the IV, for example, and always use zero instead.  If you use a 32-bit randomization string like you suggested, then you'll see a collision with high probability after only a few tens of thousands of ids, and when this happens, this leaks not only equality of two masked ids, but the xor of the two masked ids.