This is an instance where the system actually worked. Under the Health Information Technology for Economic and Clinical Health Act, Wellpoint was required to report the data breaches and it did.
The fine is hardly a burden – $2.78 for every person whose privacy was at risk.