By Charles Ornstein and Annie Waldman

When CVS Health customers complained to the company about privacy violations, some of the calls and letters made their way to Joseph Fenity. One patient’s medication was delivered to his neighbor, revealing he had cancer. Another was upset because a pharmacist had yelled personal information across the counter.

Fenity worked on a small team at CVS Health that dealt with complaints directed to the company president’s office, assuring customers their situations were rare. “I sincerely apologize on behalf of CVS Health,” Fenity says he’d respond. “This is not how we handle things. The breach of your protected health information was an isolated incident and we’ll do better.”

In fact, Fenity learned — partly from battling CVS over the privacy of his own medical information — that was “a lie.”

CVS, headquartered in Woonsocket, R.I., is among hundreds of health providers nationwide that repeatedly violated the federal patient privacy law known as HIPAA between 2011 and 2014, an analysis of federal data shows. Other well-known repeat offenders include the Department of Veterans Affairs, Walgreens, Kaiser Permanente, and Walmart.

And yet, the agency tasked with enforcing the Health Insurance Portability and Accountability Act took no punitive action against these providers.

In more than 200 instances over those four years, that agency, the Office for Civil Rights within the Department of Health and Human Services, reminded CVS of its obligations under the law or accepted the company’s pledges to improve privacy protections. (CVS did pay a $2.25 million penalty in 2009 for dumping prescription bottles in unsecured dumpsters.)

To be sure, the organizations with the most HIPAA violations are all large health care providers with many locations that serve millions of patients each year. In statements, they said they take privacy seriously. (Walmart declined to comment.)

“CVS Health is strongly committed to protecting the privacy of our patients’ health information,” CVS spokesman Mike DeAngelis wrote. “We have established rigorous privacy policies and procedures throughout the company to safeguard patient information.”

Over the course of this year, more loopholes in HIPAA and the federal government’s lax enforcement of the law have been exposed. A story earlier in December detailed how the Office for Civil Rights only rarely imposed sanctions for small-scale privacy breaches that caused lasting harm.

The data analyzed for this story show the problem goes beyond isolated incidents, carrying few consequences even for those who violate the law the most.

“The patterns you’ve identified make a person wonder how far a company has to go before HHS recognizes a pattern of noncompliance,” said Joy Pritts, a health information privacy and security consultant who served as chief privacy officer for the Health and Human Services’ Office of the National Coordinator for Healthcare Information Technology until last year.

Pritts said the government is supposed to take into account a health provider’s track record of following the law when deciding whether to pursue fines for privacy violations. “You have to ask whether that’s happening,” she said.

The VA was the most persistent HIPAA violator in the data. Time and again, records show, VA employees snooped on one another and on patients they weren’t treating. One employee accessed her ex-husband’s medical record more than 260 times. Another employee peeked at the records of a patient 61 times and posted details on Facebook. A third improperly shared a veteran’s health information with his parole officer.

All told, VA hospitals, clinics, and pharmacies violated the law 220 times from 2011 to 2014. Counted as violations were those complaints that resulted in either corrective-action plans submitted by a health provider or “technical assistance” provided by the Office for Civil Rights on how to comply with the law.

The VA has never been criticized publicly by the Office for Civil Rights or sanctioned for its string of violations.

The VA would not make an official available for an interview but said in a written statement that it “takes veteran privacy and the privacy of medical or health records very seriously.”

“The challenges VA is facing are similar to those experienced across public and private sectors, and we are continuously striving to better protect veteran data,” its statement said, adding that it provides training to staff, investigates complaints, and conducts audits of who accesses health records.

Some privacy problems — whether inadvertent or the deliberate acts of rogue employees — are to be expected. But repeated complaints may signal organizational failures, experts say.

“I don’t think it’s a defense to just say, ‘We do a billion prescriptions a year,’ ” said Mark Rothstein, chair of law and medicine and the founding director of the Institute for Bioethics, Health Policy and Law at the University of Louisville School of Medicine. “They need to be more assertive to try to figure out what’s wrong. It may be true that you can’t get down to zero, but you need to make a really good faith effort to follow up on the complaints that were filed.”

The Office for Civil Rights has broad latitude in deciding how to handle complaints. It can resolve them privately and informally, as it has chosen to do in the vast majority of instances. It also has the authority to impose fines of up to $50,000 per violation, with an annual maximum of $1.5 million. In the most egregious cases, the agency can file criminal charges against violators. It is free to post complaints online, if it protects patients’ identities.

Deven McGraw, deputy director for health information privacy at the Office for Civil Rights, said the agency’s top priority has been investigating breaches that affect at least 500 people, which providers are required by law to report promptly. “Often, when we take a look into those breaches, what we find is that they were not accidents,” she said. “What contributed to the breach of thousands, if not tens of thousands of records, was systemic noncompliance . . . over a period oftentimes of years.”

Still, McGraw acknowledged, more can be done about health providers with multiple HIPAA violations.

“I don’t like the idea of repeat offenders not being called to task for that behavior, and I would like to see us doing more in this regard,” she said, adding that the office’s case management system in the past was an impediment but is now being fixed to proactively flag such incidents.

Although the Office for Civil Rights receives thousands of complaints a year — nearly 18,000 in 2014 — it issues only a handful of financial penalties. The agency posts details online about the fines violators have agreed to pay (fewer than 30 since 2009), as well as a listing of large breaches. But that represents a tiny share of the incidents investigated by the office; the rest have been hidden from the public.

Asked why the office did not post details of repeat violations online, spokeswoman Rachel Seeger wrote in an e-mail: “Entities who are the subject of complaints are not necessarily guilty of a crime or a civil wrong. Our office makes public details of cases that result in settlements and formal corrective action agreements or civil monetary penalties on our website.”

Despite the VA’s status as the top serial HIPAA violator in this analysis, McGraw said “that doesn’t mean that we treat them any differently in terms of our overall enforcement philosophy.”

Two reports issued this fall by the Health and Human Services inspector general faulted the Office for Civil Rights’ case-tracking system for its inability to track repeat offenders.

The Office for Civil Rights said it is taking steps to fix those problems.

To gain a better understanding of the nature of the complaints received by the Office for Civil Rights, dozens of letters sent by the office to health providers detailing the allegations and how they were resolved were obtained.

In the case of CVS, common complaints included giving drugs to the wrong patients, speaking too loudly when discussing health information in front of customers, and faxing medical information to the wrong places (including to random strangers).

Many of the letters culminate with the admonition: “Should OCR receive a similar allegation of noncompliance against CVS in the future, OCR may initiate a formal investigation of that matter.”

But that doesn’t seem to have happened.

DeAngelis, the CVS spokesman, said the company’s 200,000 employees who work in pharmacies, medical clinics, and call centers are required to complete privacy training when they are hired and every year afterward. That’s in addition to regular on-the-job-training on privacy practices, he wrote.

Walgreens ranked third for the number of privacy complaints resolved with corrective actions or technical assistance, the analysis showed. Spokesman Jim Graham said in an e-mail that the company “takes the privacy and security of our customers’ information very seriously. Walgreens thoroughly investigates any concern about privacy regardless of how it is brought to our attention and will voluntarily improve practices if necessary.”

For patients whose medical information is exposed, the effects can be far-reaching.

The breach involving Fenity occurred in September 2014, when he couldn’t refill a prescription for a controlled substance — a medication to treat Attention Deficit Hyperactivity Disorder — at a CVS pharmacy and called the company’s helpline (as required) for permission to get the drug elsewhere.

All CVS employee calls were routed to the center in San Antonio where Fenity worked, and he soon discovered that a co-worker who assisted with the call hadn’t kept his inquiry confidential. Walking down a hall a couple of days later, Fenity heard the co-worker mention his name and the medical lingo used to describe controlled substance overrides.

Deeply shaken, he told a supervisor, and, after investigating, the company fired the co-worker and counseled two others who were told the information. Fenity remained so anxious and embarrassed by the incident that he took a leave of absence. (He was terminated this August for not returning.)

“It was incredibly difficult for me to reassure members that we would appropriately handle their [personal health information] or take accountability by working to avoid any additional HIPAA violations when I was experiencing the complete opposite,” he said in an e-mail.

After trying to resolve the issue within the company, he filed a privacy complaint against CVS with the Office for Civil Rights. He said he believes the company’s systems for protecting his health data were — and still are — inadequate. His complaint is pending.

CVS’s DeAngelis said the company investigated Fenity’s complaint promptly and fired the employee to blame.

DeAngelis also noted that employees can request that their calls be routed to a single employee who “would be the only representative authorized to access their prescription account. In fact, following Mr. Fenity’s incident, this option was offered to him and he accepted.”

Fenity can still recall the chill of realizing the information about his medication was out.

“It’s like feeling your clothes have been ripped off in the middle of work,” he said. “That’s what it feels like. You feel so exposed.”