The cost of HIPAA privacy violations