HHS adjusted the maximum amount it will penalize healthcare providers, health plans and their business associates for HIPAA violations, lowering the cap for less-severe violations and basing the fines on culpability.