For the record, I believe extreme violations of HIPAA can result in criminal charges, or so I've read. (Accidentally sending PHI to New Relic almost certainly does not qualify for jail time.)