not a lawyer, but I think intent is a big piece. That said, if you ever feel pressured to do something that you know, or even think, might "not be quite right", diplomatically argue your point and get things in writing. Even an email thread between you and a manager is good. The idea is this: if the fecal matter hits the oscillator and auditors come in, you want evidence that you were doing what you were told, despite your protests.
Unless you're boss tells you to do something so egregious that after the fact it will look like you're stealing or committing fraud you'll be fine.
If your boss says "Hey download all of the PHI for these celebrities to a flash drive and load it on your computer at home" you should definitely say no or get it in writing.
But if your boss says "hey I need a copy of George's medical records, e-mail them to me" as an individual you won't get in any personal liability for it.
