HIPAA is always going to be a joke. Walk around the hospital's parking lot and drop a bunch of malicious USB drives with the logo of the hospital on them. Someone is bound to pick one up and stick it in a machine on the network.