Patient privacy breaches could mean hefty fines