Hundreds of patient data breaches are left unpunished