Hundreds of patient data breaches are left unpunished, reveals The BMJ