If this had been a civilian medical concern then they would face BIG $$ penalty under the HIPAA (Healthcare Information Privacy and Accountability Act) legislation. But, because government is exempt, all they get is a "whoopsie, sorry about that"
That ME and his staff should be replaced. This is untolerable.
Semper Furious
PCRM is certainly private. I wonder what sort of penalty could be assessed against them, both for fraudulently "requesting" the information in the first place, and for illegally releasing it to the news media.
Sadly, the Journalists-Über-Alles SCOTUS precedents would prevent the Wall Street Journal reporters from ever being successfully sued for this heinous privacy violation. All we can do is hope that the reporter(s) involved will get some karmic justice of their own. I've always said that if the public would start violating the privacy of reporters and posting their personal information on public web sites, the reporters would learn some morals REAL quick.