Asklemmy

Something I haven't seen mentioned yet - who is the company's HIPAA "Compliance Officer"? If it's anyone other than your boss, you could document the situation to them in an e-mail. If you want to be slick about it, ask them if there is "still any compliance need to keep the replacement machine ready or if it would be OK to repurpose it, given [your boss's name here]'s decision not to move forward with the upgrade." They're on the hook for compliance violations, so they'll likely see to it.

I would also suggest making a habit from now on of documenting verbal conversations that result in actionable decisions in short e-mails to the other party: " To recap our discussion, [bullet point list]"

You can excuse this as being for your own reference so you don't forget any to-do items or so that they can correct any misunderstanding on your part, but it makes for a fantastic CYA if that ever becomes necessary. For really important items likely to bite someone later, print a paper copy if you don't fully own and control the machine AND the e-mail local archive. Only bring those out if absolutely necessary, as in when SOMEBODY will be fired or you're about to be legally scapegoated. They'll save your butt once, but it will probably be time to start looking for another job because the boss will think either that you should have pushed harder earlier to fix the issue or be worried about their inability to scapegoat you in the future.