The severity of fines for non-compliance with HIPAA has historically depended on the number of patients affected by a breach of protected health information (PHI), along with the level of negligence involved. Few fines are now issued in the lowest “Did Not Know” HIPAA violation category, because there is little excuse for not knowing that organizations have an obligation to protect PHI.