How private practices can survive regulatory risk and fines