"As another example, any person, including an employee of a covered entity or business associate, that commits certain acts knowingly may be fined up to $250,000 and/or imprisoned for up to 10 years.Notably, while business associates now have direct compliance responsibility, they also retain contractual responsibility and risk." . . . .