This is the wrong takeaway. The article states pretty clearly from the interview with Senator Mark Warner: > “To my knowledge, Health and Human Services has d

This is the wrong takeaway. The article states pretty clearly from the interview with Senator Mark Warner: > “To my knowledge, Health and Human Services has done nothing about it,” Warner told TechCrunch. “As Health and Human Services aggressively pushes to permit a wider range of parties to have access to the sensitive health information of American patients without traditional privacy protections attached to that information, HHS’s inattention to this particular incident becomes even more troubling,” he added. It's not that they're doing nothing, they're supposedly making it worse. They're also underfunded. OCR budget dropped to 10% of its previous budget between 2017 and 2018: https://www.hhs.gov/about/budget/fy2018/budget-in-brief/ocr/index.html https://www.hhs.gov/about/budget/fy2018/budget-in-brief/ocr/... So, when you ask "why would these companies care?", I think the current federal government is trying to say "these companies _should not_ care."