The breach shows yet again how ineffective HIPAA has been in getting organizations that handle healthcare data, to take better care of it, said Deborah Peel founder and chairman of the .

Much of the problems stem from the indiscriminate sharing of sensitive personal information among "legions of secondary users", she said. The average hospital has between 200 and 300 outside vendors and partners with access to patient data, Peel said.

"We do not have an effective federal health privacy law. HIPAA was gutted in 2002 when control over who can see and use patient data for all routine uses was eliminated," she said.

The only way to really get a grip on the problem is to allow patients to exert more control over who has access to their data. "Data should be used for a single purpose after the patient gives consent such as consent to use the data to pay a claim or send to a consultant."

"Consent should be obtained for any secondary or new uses of data," she said. All organizations that handle health data, including third parties should be certified to adhere to the highest standards of data security, Peel said.