I'm a new hire low-level engineer at a large company in the US. When signing up for my benefits/insurance package, I noticed that the password requirements included a 9 character maximum. Needless to say, I don't feel very comfortable committing personal information to such a lax requirement. 
Due to my (low) status, is it acceptable to bring this concern to IT and/or HR, or would that rock the boat?  I brought it up colloquially with my direct managers (with whom I have good relationships), and while they acknowledged the bad practice, they didn't seem too bothered about doing anything about it. They are most likely used to it, having signed up years ago.
I would very much not like to go with the flow and (a) not feel that my personal information is secure, and (b) let this practice go unnoticed or unreported. Of course, I feel silly thinking that the company would change a long-standing (and perhaps minor) policy just for me. But after all, every bad security practice is fine until it becomes very not fine very quickly.
 Since this is workplace and not a security SE, please that assume this is bad security practice that should be avoided so that we can discuss the question at hand, not proper security policy.
 In response to some feedback in the comments, please note that I am not suggesting going to the head of IT and screaming bloody murder about the massive security hole in their system. I had more of the following in mind:
Hi [IT/HR person with whom I have a relationship], I noticed there was a 9 char password limit on [...], is that something that can easily be changed to allow more secure passwords? Thanks, Me.