That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical.
… Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.
[0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials...