Then set up a mock-up site at https://10.3.42.8/, and just show a journalist on your laptop. Ask to remain anonymous, then switch off your web server and let them know that "it has since been taken down, but anybody else could make a new one".

That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical.

… Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.

HIPAA doesn't apply to individuals, it only applies to health institutions and their employees and business associates[0].

[0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

They are broadcasting patient data. It’s not more stealing than me publishing in a web site CB conversations.