Â鶹ŮÓÅ

Employees and contractors at VA medical centers, clinics, pharmacies and benefit centers commit thousands of privacy violations each year and have racked up more than 10,000 such incidents since 2011, a ProPublica analysis of VA data shows. The breaches range from inadvertent mistakes, such as sending documents or prescriptions to the wrong people, to employees' intentional snooping and theft of data. Not all concern medical treatment; some involve data on benefits and compensation. Many VA facilities and regional networks are chronic offenders, logging dozens of violations year after year. (Ornstein, 12/30)

CVS is among hundreds of health providers nationwide that repeatedly violated the federal patient privacy law known as HIPAA between 2011 and 2014, a ProPublica analysis of federal data shows. Other well-known repeat offenders include the U.S. Department of Veterans Affairs, Walgreens, Kaiser Permanente and Wal-Mart. And yet, the agency tasked with enforcing the Health Insurance Portability and Accountability Act took no punitive action against these providers, ProPublica found. In more than 200 instances over those four years, that agency, the Office for Civil Rights within the U.S. Department of Health and Human Services, reminded CVS of its obligations under the law or accepted its pledges to improve privacy protections. (CVS did pay a $2.25 million penalty in 2009 for dumping prescription bottles in unsecured dumpsters.) (Ornstein and Waldman, 12/29)

Up until a few years ago, many physicians were using paper charts or dictating into recorders and typing charts out afterward. Now, federal mandates from the Centers for Medicare & Medicaid Services penalize hospitals and clinics that do not keep records electronically. (Caiola, 1/1)