Anthem Blue Cross said the personal information of more than 13 million Californians was possibly exposed in a data breach last month.
It's just the latest in a growing number of data breaches.
In a new review, the nonprofit news organization Pro Publica found since 2009, health care companies have reported more than 1,140 large data breaches to the federal government. More than 41 million people have been affected.
These breaches can expose sensitive medical information and Social Security numbers. Even so, Pro Publica's review found the Office for Civil Rights, the federal agency charged with oversight, has issued only 22 fines against health care organizations for data breaches in the last five years.
In contrast, the California Department of Public Health issued 22 fines last year alone for breaches of patient records.
Critics said the Office for Civil Rights just doesn’t have the resources to do its job, but President Barack Obama wants to give the agency more money.