A table with all fields NULLable with important, sensitive data I have a requirement for a database table to hold sensitive patient information about their lifestyle (alcohol/ drug use / injecting etc).

On screen the information is sectioned into tabs - "alcohol", "drugs", "injecting" and so on. Some of the data is co-dependent (ie: data in one tab may depend on what is input in another). 

I was considering storing all of the data captured in the tabs (circa 25 fields - maybe more, but not much more) in a single table, because of the aforementioned co-dependency. All of the fields in the table would be NULLable (edit: for two reasons: (1) because people might have alcohol problems but not drug problems and vice versa and (2) the data can be in DRAFT or PRODUCTION state - in draft incomplete data is acceptable, but in production relevant data must be supplied) 

To improve data integrity I would employ CHECK constraints to ensure that data was supplied for sets of fields in the table IF certain BIT flags were set (e.g. we are in PRODUCTION mode and a flag named HasUsedAlcohol is set, this mandates all alcohol related fields be populated; HasUsedDrugs would mandate all drug related fields be populated)

Additionally this table may be used to produce reports.

My question is - is this a sensible, maintainable solution? And if not, why not?

Database target is SQL Server 2012.

Thanks in advance.
I wouldn't be too concerned about 25 columns.  That's not an extremely high number.  It doesn't even approach violating Swart's Ten Percent Rule (102 columns).  Of course, the "rule" there is discussing a limit, not a goal, so keep that in mind 

In my mind, ideally, each of these separate "forms" (tabs) would be backed by its own table (AlcoholAbuse, DrugAbuse, Injections, etc), which would then be linked back to the patient by a foreign key constraint.

However, you mentioned that there are data validation concerns that cross forms.  Maybe if you answer "yes" to certain questions on the drugs form, then certain questions on the injections form are required.

Since CHECK constraints are really the best way to enforce what you're describing, that would be mean they all need to be in the same table.  

Your other options, if things were in separate tables, would be to move validation into the application layer, or use triggers to ensure the data in the different form tables is valid on each insert / update.

Since the number of columns isn't outrageous, and you probably don't want to incur the complexity of dealing with triggers, I think one table with conditional CHECK constraints is a valid solution.  

This solution seems maintainable to me, and fairly easy to reason about, since all of the "rules" are in one place (one table, and the constraints applied to that one table).