A company that handles medical records and doesn't have company email accounts, leaving individuals to open accounts into HIPAA-protected databases in their own way, is just screaming HIPAA violations. 

It is, for example, a HIPAA violation to email electronic protected health information, or ePHI, to personal email accounts. This can result in a fine for each occurrence.

I suggest you have a look at [this](https://www.hipaajournal.com/common-hipaa-violations/) and ask yourself whether any of the violations they list have occurred. If so, perhaps your next step is to talk to a lawyer who specializes in HIPAA violations. Not mentioning violations that you know have occurred can itself be a violation, so I wouldn't just let it go.