I understand the difference between odds and risk. The risk is high (assuming you use the harshest possible penalties) but the odds are infinitesimally long.

Google and find who has actually faced penalties from HIPAA violations and what those penalties were. How many serious fines/prison sentences have been handed down? Who was at fault? Were they random no-name startups?