Department of Veterans Affairs officials have racked up more than 10,000 privacy breaches since 2011, making the VA the nation’s most prolific violator of laws protecting patients’ personal medical information.

However, the government agency tasked with punishing providers who break the law, called the Health Insurance Portability and Accountability Act, took no disciplinary action against the VA, according to a review by ProPublica.