I worked for a healthcare claims processing company that at the time stored all the production database and server passwords in a text file accessible to half t

I worked for a healthcare claims processing company that at the time stored all the production database and server passwords in a text file accessible to half the company, all because the chief architect didn't want to remember passwords. Yet we were covered by HIPPA and "passed our audits". If people don't care to follow the law and can manipulate the audit, who is going to stop them?