There should be fine a 1% of annual revenue for every day these companies are in non compliance with prison for the ceo if they are non compliant for over thirty days.
Author here. The problem is checking compliance. By publishing these files, they seem compliant, but really aren't. Since the payors are the guardians of the data, it's very difficult to check that what they're posting is correct. That was the main thrust of the article.