What penalties can be enforced against a person or entity that willfully and knowingly violates the HIPAA Privacy Rule with the intent to sell, transfer, or use PHI for commercial advantage, personal gain, or malicious harm?