HIPAA violations not drawing fines