One conviction that netted $9,000 in penalties hardly seems worth an investment of over a third of a billion dollars. Without proper government agency oversight, it comes as little surprise that there has been only one HIPAA conviction.