Although there are many presentations, courses and services now available to help health care organizations to become HIPAA compliant, the real issue for the health care organization is to determine the most cost effective ways to understand their risks and to minimize the vulnerability to a breach and their liability when a breach does occur. This presentation focuses on understanding the responsibilities of the health care organization, the liabilities resulting from those responsibilities and the penalties that can be assessed as a result of a breach of patient protected health information.