Entities should do everything it takes to avoid HIPAA fines and penalties