In some cases, HHS´ Office for Civil Rights may impose significantly higher fines if the Covered Entity has a history of non-compliance. In this case, the Covered Entity – Arizona-based Banner Health – had previously experienced a cyber-attack exposing the unsecured ePHI of 3.7 million patients. An investigation into the breach identified non-compliance with multiple Security Rule standards.