At the end of the day I don't think we're arguing here and I'm not saying that the OP _shouldn't_ speak to a lawyer but here are a few choice comments from this post that I'll use to prove my point:

First - the TOP comment in this post: >>" I would advise you to temporarily close your site and hire a lawyer straight away."

And other top level comments: >> You should asap bring the app down, contact all users, send them their info, delete them from your servers, notifying them of that and get a lawyer specialising in health related law.

>>If you can’t answer that question you really need to listen to the people telling you to take it down until you can work it out.

>>Speaking as someone who works in IT in healthcare - you need to close your site down immediately, do not pass Go, etc., and hire a lawyer.