Favorite would be a highly customized zsh.

fizsh (not fish) is what I actually end up using, as I can’t be bothered to copy that config around and retune it for each machine. Gives me the syntactic sugar of zsh with common default options on by default, an OK default prompt, and doesn’t break POSIX assumptions like fish. Also Installs quickly from the package manager without needing to run through the zsh setup each time - unlike oh-my-zsh. And if I still need customization, all the zsh options are still there.

Notify the maintainer of the open source tool - they’re in the best position to push for compliance. They have the power to revoke the company’s license.

Something I haven’t seen mentioned yet - who is the company’s HIPAA “Compliance Officer”? If it’s anyone other than your boss, you could document the situation to them in an e-mail. If you want to be slick about it, ask them if there is “still any compliance need to keep the replacement machine ready or if it would be OK to repurpose it, given [your boss’s name here]'s decision not to move forward with the upgrade.” They’re on the hook for compliance violations, so they’ll likely see to it.

I would also suggest making a habit from now on of documenting verbal conversations that result in actionable decisions in short e-mails to the other party: " To recap our discussion, [bullet point list]"

You can excuse this as being for your own reference so you don’t forget any to-do items or so that they can correct any misunderstanding on your part, but it makes for a fantastic CYA if that ever becomes necessary. For really important items likely to bite someone later, print a paper copy if you don’t fully own and control the machine AND the e-mail local archive. Only bring those out if absolutely necessary, as in when SOMEBODY will be fired or you’re about to be legally scapegoated. They’ll save your butt once, but it will probably be time to start looking for another job because the boss will think either that you should have pushed harder earlier to fix the issue or be worried about their inability to scapegoat you in the future.