Penalties for HIPAA noncompliance are no joking matter. Fom the less-serious "Reasonable Cause" to the more-serious "Willful Neglect," these civil penalties can range from $100 to $50,000 per incident with no jail time to more serious offenses resulting in up to $250,000 in fines and 10 years in prison, especially if information was taken under false pretenses or disclosed on purpose.
If that wasn't enough of a deterrent, state laws could impose additional penalties for the same offenses. Also, even if you didn't intend for noncompliance to occur or it was an accident, you are still liable. There is no safe haven here.