Washington ? In the three years since Americans gained federal protection for their private medical information, the Bush administration has received thousands of complaints alleging violations yet has not imposed a single civil fine and has prosecuted just two criminal cases.

Of the 19,420 grievances lodged so far, the most common allegations have been that personal medical details were wrongly revealed, information was poorly protected, more details were disclosed than necessary, proper authorization was not obtained or patients were frustrated getting their own records.

The government has “closed” about 73 percent of the cases – more than 14,000 – either ruling there was no violation or allowing health plans, hospitals, doctor’s offices or other entities to promise to fix whatever they had done wrong, escaping any penalty.

“Our first approach to dealing with any complaint is to work for voluntary compliance. So far it’s worked out pretty well,” said Winston Wilkinson, who heads the Department of Health and Human Services Office of Civil Rights, which is in charge of enforcing the law.

While praised by hospitals, insurance plans and doctors, the approach has drawn strong criticism from privacy advocates and some health industry analysts. They say the administration’s decision not to enforce the law more aggressively has failed to safeguard sensitive medical records and made providers and insurers complacent about complying.

“The law was put in place to give people some confidence that when they talk to their doctor or file a claim with their insurance company, that information isn’t going to be used against them,” said Janlori Goldman, a health care privacy expert at Columbia University. “They have done almost nothing to enforce the law or make sure people are taking it seriously. I think we’re dangerously close to having a law that is essentially meaningless.”

The highly touted Health Insurance Portability and Accountability Act – commonly known as HIPAA – guaranteed beginning in 2003 that intimate medical information was protected by a uniform national standard.

The law gave the job of enforcement to HHS, including the authority to impose fines of $100 for each civil violation, up to $25,000. HHS also can refer possible criminal violations to the Justice Department.

Wilkinson’s office has referred at least 309 possible criminal violations to the Justice Department. Two cases resulted in criminal charges: A Seattle man was sentenced to 16 months in prison in 2004 for stealing credit card information from a cancer patient, and a Texas woman was convicted in March of selling an FBI agent’s medical records.