So with no consequence to these massive lapses, why would these companies care?
The article states pretty clearly from the interview with Senator Mark Warner:
> “To my knowledge, Health and Human Services has done nothing about it,” Warner told TechCrunch. “As Health and Human Services aggressively pushes to permit a wider range of parties to have access to the sensitive health information of American patients without traditional privacy protections attached to that information, HHS’s inattention to this particular incident becomes even more troubling,” he added.
It's not that they're doing nothing, they're supposedly making it worse.
They're also underfunded. OCR budget dropped to 10% of its previous budget between 2017 and 2018:
https://www.hhs.gov/about/budget/fy2018/budget-in-brief/ocr/...
So, when you ask "why would these companies care?", I think the current federal government is trying to say "these companies _should not_ care."
My honest opinion is that they know healthcare specifically is so far behind meeting their regulator requirements they have been trying to slowly phase in penalties.