Both individual healthcare workers and organizations can face penalties for HIPAA violations. While the primary responsibility often lies with the covered entity, individual workers, including employees, contractors, or other personnel, can also be held accountable for breaches, especially in cases of intentional disclosure or willful neglect of PHI.