Encrypted fields are loaded from disk file to process memory only after file's HMAC validation is successful. Data is still encrypted in memory and will be decrypted later, on demand, when it needs to be displayed to the user (cipher is initialized on process start). The system also allows user to add new data which will be encrypted to memory and later saved to disk. CBC mode is used.
Besides file's HMAC, does adding HMAC to each encrypted field and validating it before decryption makes sense? Or in other words, should I authenticate memory data which was loaded from authenticated disk file? The goal is to make make the app as secure as possible and minimize possibilities of tampering.