The U.S. Department of Veterans Affairs and CVS Health lead the nation in federal citations for patient privacy violations, according to a new analysis.

The review, by the nonprofit journalism organization ProPublica found the VA and CVS received the most privacy complaints that resulted in corrective action plans or “technical assistance” provided by the U.S. Department of Health and Human Services from 2011 to 2014.

Thousands of times a year, the Office for Civil Rights of HHS privately resolves complaints about possible violations of the Health Insurance Portability and Accountability Act. It advises violators to fix purported problems and prods them to make voluntary changes.

• In 2014, the most recent year for which data is available, HHS received more than 17,000 complaints, as well as tens of thousands of self-reported breaches of medical information.
• Some providers inadvertently, or in some cases deliberately, shared patients’ medical information without their permission.
• The top five categories of complaints in 2014 were impermissible uses and disclosures, safeguards, administrative safeguards, access and technical safeguards.

CVS and the VA told ProPublica that they are committed to protecting patient privacy.

The VA said: “VA takes veteran privacy and the privacy of medical or health records very seriously.”