Consequences for HIPAA violations don’t stop when a business closes