Were you to post to full-disclosure, you'd probably not see a lick of trouble. You exercised due diligence. You gave them more than ample time to acknowledge the bug, and they continue to have a flaw that allows arbitrary people to see personal information.
Then again, given the information you've given, there's a different route you can probably take. This sounds very much like a HIPAA violation, and the federal government takes those very seriously. Report it here:
http://www.hhs.gov/hipaa/filing-a-complaint/what-to-expect/i...
if they are a health entity that would fall under HIPAA rules.