Well you are so overreaching on HIPAA as to suggest that OP is in some violation of the law. He is not an employee to the company. And not disclosing a password to a workstation has absolutely nothing to do with disclosing medical records.