hipaa compliance

I’ve done some research, but cant find the answer to my question. Can anyone help? we have tightvnc installed on all client machines for support reasons, and it has been recently brought up that this may be a hipaa violation. Our i.t. department doesnt think that it is, because it is password protected, and only 3 members of our staff can access clients machines with it. Basically, we can’t do anything with tightvnc that we couldnt do by walking up to a computer and logging in. Any thoughts?