Recent HIPAA settlements highlight the weaknesses in healthcare security