A HIPAA  breach can happen anywhere and at any time. Every covered entity needs to be prepared for the worst and hope for the best. Scroll through and see how the biggest breach in your state affected the population. There are some great examples of how even small practices that were breached had a big impact. Except for South Dakota. Everyone should be like South Dakota. 

Something worth mentioning is that these are only the biggest breaches reported to the Office of Civil Right, a sub agency of Health and Human Services. Hundreds of breaches go unreported all the time. The importance of reporting breaches cannot be stressed enough. Yes, you may incur fines. However, if the breach is reported in a timely manner (60 days from discovery) and the covered entity was taking all reasonable precautions to maintain security and compliance, then your fines will be much less or even waived. The big fines are given to those covered entities who try and hide the reality of their breach.