A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.
It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.
I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, perhaps your next step is to talk to a lawyer who specializes in HIPAA violations. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go.