Penalty tiers, recent OCR enforcement actions, and the controls that prevent the most expensive findings.