I think the HIPAA stuff specifically could fuck them HARD. That can be more easily pursued civily. Criminal Courts don't mean much to companies because they have to pay a minor fine and it goes away, because criminal courts don't seek relief or compensation. Civil courts are where corporations can get gigafucked.