CVS is among hundreds of health providers nationwide that repeatedly violated the federal patient privacy law known as HIPAA, yet the agency tasked with enforcing the law took no punitive action.