An authoritative single source for this may be hard to find as it is, ultimately, subjective. However, not sharing credentials is a fundamental expectation of our current computing paradigm. The use of logins and passwords is fundamental to this reality and to step out of this violates that paradigm and every system that has been built around it.
Access Restricted Resources
IT restrictions are similar in intent to a locked file drawer or a bank safe deposit box. It's similar to laws and general expectations regarding opening other people's mail. Sure that hallmark card with a signature isn't sensitive per se, but it has a specific intended audience and access list.
Regardless of the contents and their meaning or value, the items are protected and access has been restricted. Obviously we could argue about value, sensitivity, etc. but that's after the fact.
You don't walk around with your co-worker's name, building access key, or sit at their cubicle. Why would you use their IT resources? All of the issues and concerns of impersonation in a physical setting exist on networks and disks. The impersonation risks are greater given the ability to identify this impersonation is lower and the potential length of impersonation lasts longer with system credentials.
Most Businesses are "at will employers"
As such, and since you are likely accessing their resources, through their systems, your only actual line of legal defense is to quit. The nuances of this, including issues of BYOD is likely out of scope for this site or at least my area of expertise.
The secondary aspect of this though, is that the business already, likely, has access to everything you have or are doing. A good business prompt is risk vs. reward. For no reward you gain significant risk for all parties. The password receiver is now, as noted by schroeder, liable for actions taken under your credentials. You are liable to any actions that anyone using your credentials takes. Who's the next person to get the password? Even if you trust everyone completely, do people make mistakes? How might those impact individuals and the organization?
Additional risk arises as the business is fostering an environment of credential sharing and risks all resources through erosion of basic best practices that counter (spear) phising, social engineering, keylogging, principles of least access, and more. Is the person asking your credential actually tier 1 support? You have nothing of value on your computer, but who in-turn will give "you" their password?
As a final aside, HIPPA/HITECH does not, from my understanding, have specific wording for passwords or password sharing. That's how you make a "good" law though. The ability to meet the numerous data security, segmentation, and auditing requirements is not possible in an environment where credential sharing occurs. When people share passwords then ACLs are meaningless and auditing is essentially forgery of actual access. From my plebeian perspective, this is a violation of federal law.
***Note I speak/write colloquially with "you"s and don't mean to indicate Devil's Advocate but rather any general reader or person this may apply to.