A new report on the security of the personal information of health care patients indicates that steps need to be taken and rules enforced.