uhhhhhhhh

Do you know what the actual risk is here?

Personally, I wouldn't stake my future on hoping the government doesn't notice what my hypothetical law-breaking company is doing. Or that my law-breaking unethical CEO won't lie and try to throw me under the bus if/when the company eventually gets caught.

I'll restate that I recommend OP talk to a knowledgeable lawyer to get an informed assessment of what kind of risks he/she is undertaking.

Will echo other comments and say that I enjoyed this post.

IANAL, however, in all seriousness...

I think you should talk to a personal lawyer about your situation ASAP, especially now that you posted this publicly. HIPAA is not to be trifled with and now you've shared that you have knowledge of a breach. You've also provided enough detail in this post that (if found and traced back to you) could be used as proof that you were knowingly complicit in breaking the law.

You want to retire early? I would not be messing around in a company that skirts the law. All this work could be for naught. You are high enough up that you have a decent chance of getting caught in the inevitable downfall of this company.