I would not do as your company asks without getting some advice, preferably from a lawyer, preferably one who specializes in HIPAA violations.
A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations.
It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.
I suggest you have a look at this and ask yourself whether any of the violations they list have occurred. If so, then you might want to talk to that lawyer. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go. What's more, they could try to blame you if they get audited, say they never told you to use your personal accounts and you did that all on your own.