Under HIPAA regulations, healthcare facilities are required to report patient information-related security or privacy breaches that may result in fines. If such breaches are not reported, and the federal government learns of them, then ____.

A. heavier fines are levied

B. the healthcare facility's security officer can be fined

C. the healthcare facility's owners can be fined

D. the employee who failed to report the breaches may face criminal charges