I've never worked in the medical industry but I know many people who have, who basically told me HIPAA violations are extremely common and only enforced for a fraction of violations that actually occur. My ex used to work in medical insurance (for a very, very big company) and estimated that maybe 3% of HIPAA violations are actually enforced. I used to think HIPAA was a huge deal until she told me story after story of violations that were ignored.

I think HIPAA is the sort of thing where if you hear about it then it's taken seriously, but the overwhelming number of violations are just ignored and you never hear about them. I'd like to be wrong but unfortunately that's the information I've been fed by people more knowledgeable than me.