Civil + The hipaa violations all about state privacy officer who else you keep patient can enforce gives the maximum civil actions