There is ALOT of BAD info in these posts, but some good info. I myself am bound by HIPPA laws in my profession. All this means is that I am licensed and have been forced to know the HIPPA laws. I also know that I can loose my license if I violate the HIPPA laws. So let me post a couple of links here for you to check out:

http://www.hhs.gov/ocr/hipaa/
HIPAA.ORG
HIPAA / Law: Legal Question and Answer about HIPAA

Then find out how your SW is licensed. Most likely he/she has a license. Under their license they are bound by several standards. If they violate one or more of those standards then they are subject to loosing his/her license. Just call up your SW and ask what linceses that he/she has. Then at that point it is just using a little Google and you will have the phone numbers to the complaint department for the licensing organization that governs your SW.

Good Luck