Go read the requirements - HIPAA is really 90+% about disclosure and reporting of events that compromised private patient information. There is virtually nothing in HIPAA that is aimed at preventing privacy breaches in the first place. Once a breach is disclosed, the penalties in HIPAA pretty much vanish.