[chasb]

HHS prefers not to use civil monetary penalties, but they hit when they do: https://www.hhs.gov/hipaa/for-professionals/compliance-enfor...