When a HIPAA violation or data breach occurs, organizations that have “exercised a reasonable amount of care” to comply with HIPAA will be treated more leniently than an organization that has demonstrated “willful neglect”. This can reduce the financial penalties issued by the HHS Office for Civil Rights, or the time the organization is required to comply with a Corrective Action Plan.