Each individual must have their own user account to be compliant with the Terms of Use and with HIPAA requirements. Shared or generic user accounts do not meet those requirements.
For more information, Health and Human Services has produced a helpful guide about the Privacy and Security of protected health information (PHI): http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/adminsafeguards.pdf