Lessons from a year reporting on loopholes and lax enforcement of the federal patient-privacy law known as HIPAA.