I worked in healthcare for ~20 years. The worst casual breach I ever witnessed was a state health director emailing an unencrypted spreadsheet of all of that states HIV+ persons to a widespread mailing list including name, DOB, SSN, etc. Sadly it was not accidental (would that be better?). Even worse no one batted an eye and it was not even a notable event.

For all the HIPAA lip service paid at the front end in many sites, all the data walks wholesale out the backend to an absolute parade of "hipaa business associates". It is a firehouse of data that is vacuumed by almost everyone.

Health and human services has statutory authority to fine $50k per patient violation. They never ever ever do and so no one really cares.