
Dr. Skin hired several people to improve the marketing of his practice. In order to make things simple, he provided them with all of his patients' records to allow them easy access to patient demographic information. Dr. Skin is assured by colleagues that although the involved activity may represent a HIPAA violation, no penalties have been assessed to small practices such as his. Is this true?