And now for this month's question:

Q:  My company is a HIPAA-covered entity. We heard that another HIPAA-covered entity recently entered into a settlement with the U.S. Department of Health & Human Services ("HHS") under which it had to pay civil fines to the federal government for violation of the HIPAA privacy and security regulations. What happened in this case, and what can we learn from it?