Notify the maintainer of the open source tool - they’re in the best position to push for compliance. They have the power to revoke the company’s license.

My apologies - I should have caught that. Fixed.

Something I haven’t seen mentioned yet - who is the company’s HIPAA “Compliance Officer”? If it’s anyone other than your boss, you could document the situation to them in an e-mail. If you want to be slick about it, ask them if there is “still any compliance need to keep the replacement machine ready or if it would be OK to repurpose it, given [your boss’s name here]'s decision not to move forward with the upgrade.” They’re on the hook for compliance violations, so they’ll likely see to it.

I would also suggest making a habit from now on of documenting verbal conversations that result in actionable decisions in short e-mails to the other party: " To recap our discussion, [bullet point list]"

You can excuse this as being for your own reference so you don’t forget any to-do items or so that they can correct any misunderstanding on your part, but it makes for a fantastic CYA if that ever becomes necessary. For really important items likely to bite someone later, print a paper copy if you don’t fully own and control the machine AND the e-mail local archive. Only bring those out if absolutely necessary, as in when SOMEBODY will be fired or you’re about to be legally scapegoated. They’ll save your butt once, but it will probably be time to start looking for another job because the boss will think either that you should have pushed harder earlier to fix the issue or be worried about their inability to scapegoat you in the future.

And not subject to compliance based retention standards

On the “how far you’re willing to travel” front, the reality is it’s much harder and more expensive to get the surgery in the US. One of the consequences of this is that most US surgeons aren’t 100% specialised on SRS so they may not have the level of experience of someone elsewhere.

You didn’t request specific surgeon references, but my partner used Dr. Chettawut Tulayphanich and has never regretted the choice. There’s a level of competence that only comes with repeated practice, and if there’s a US surgeon with over 3,000 of these surgeries behind them I’d be beyond shocked.

The last time it went to the Supreme Court, they couldn’t make up their minds. The current court would probably support it.