HIPAA violations lead to multimillion-dollar penalties