Health organizations are required by federal law to report data breaches that affect more than 500 people to the Department of Health and Human Services. The department’s Office of Civil Rights publishes the equivalent of a data breach “Wall of Shame” on its Web site — which today includes 380 breaches affecting more than 18 million people.