HIPAA / HITECH
Estimate HIPAA civil monetary penalty ranges by culpability tier and records affected.
Number of individuals whose PHI is involved (rough worst-case proxy for violation count).
Since HITECH (2009), business associates are directly liable for HIPAA compliance.
