In my experience working at several US health IT companies, company principles for following HIPAA rules (especially patient privacy) were taken seriously at all levels and considered more than just compliance check boxes. Regardless of the ethical issues, if you get a reputation for being sloppy and the trade press writes negative articles then that can kill your sales pipeline.
A way of speaking, it has nothing to do with stuff like "Do no evil", "Respect, Achievement, Renewal, and Challenge", "Excellence, Innovation, and Responsibility" and similar word games with a yearly HR training, just to check a box.
