Hacker News Reader

Look up the cap on fines per year. It's less than $2m.

I've consulted for healthcare companies where that is a literal rounding error on their bottom line.

They. Do. Not. Care.

There's also a criminal liability aspect to it. I've worked for healthcare companies too and they do care, at least enough to have it in the conversation and to include the HIPAA officer in those conversations. Nowhere I have worked have they been flippant about it.

I agree with you that the cap is too low. It should cap based on gross or revenue. I suspect it's so that the smaller companies won't get destroyed by fines leaving the larger ones largely unaffected, but I'm speculating.

Reply on news.ycombinator.com