HIPAA violations can cost a lot of money (up to $50,000 per record, depending on the severity level). A single incident can cost a few million dollars in fines, so there's a _very_ strong incentive to do things the right way.