And HIPAA spells out fines of up to a very high amount for breaches. This firm didn't even get the minimum fine per person.