I would suggest asking for a contract to be made, or you make one and ask it to be signed. The purpose of a contract is to protect both parties.
You can simply state (the contract should be more in depth than the following "In the unforeseen event that there is a breach in data I cannot be held responsible for any HIPPA violations". I would include that you are developing it to be as secure as you can make it within your ability and time allowance and that once you hand the product off you are not responsible for any misuse of the product.
I used to work for a pharmacy and HIPPA violations are VERY serious in the US and am honestly surprised that they did not make you sign a non-disclosure agreement.
Basically, within this contract you:
- Should not be responsible for the product once it's no longer in your hands
- Should not be responsible for misuse of the product by the company, it's clients or individuals with malicious intent
- Should not be sued by a client of the company due to any reason about the product and it's use. If a client of the company wants to create a suit, they should go after the company who is the owner of the product.
- Should have an agreement as to how you can reflect the work you've done on this project. Can you have your name on the product as the developer? Can you put this project on your resume? Can you reuse the code in the future? Can you develop a similar product for a competing company?
The company:
- Should receive the developed product that is as secure as your ability allows.
- Should take full responsibility as to how the product is used internally and externally.
- Should outline situations in which you may be requested to work on this project again. Is this a one and done deal? Do they expect you to update the product for them in the future? If a new developer can't understand your code can they talk to you? If the product does get hacked are you required to try to patch the security hole?
I would also talk to the company about consulting with a lawyer to create the contract and the company should be the one to pay for the lawyer if that route is taken.
EDIT 1:
Based on a comment by @cdkMoose
You should also look into getting professional liability insurance. You can not entirely contract away your responsibility. If your work fails in some way that should have been caught and creates a security hole you could still be responsible. Contracts won't protect you from something that could be considered professionally negligent.