A medical practice knows that its billing office is open to public viewing because it is attached to the front welcome-desk as a time-saving device for communication between billing staff and front office staff. The practice knows that other patients' PHI billing information could easily be viewed by patients standing at the front desk, but chooses not to change the scenario. What kind of penalty could the practice face?