New rules could mean hell to pay for small health care breaches