Once again, the organizations are reminded that payments for non-compliance are not limited to a small fee. The enterprise-wide risk assessment and analysis is needed to understand where to put protections against the breaches. http://www.hhs.gov/about/news/2015/12/14/750000-hipaa-settlement-underscores-need-for-organization-wide-risk-analysis.html