Universities can be punished by NIH in addition to the feds if they violate privacy rules in clinical studies. Columbia was threatened with losing all their research funding if they didn't get their act together after a big breach a few years ago.
But I know plenty academic researchers with a "move fast and break things" and "ignore all rules" attitude. In any highly-competitive system there will be those that gain an advantage by being amoral while everyone else follows the rules. Healthcare is probably especially vulnerable to this as the rules (and legitimate companies following them) has resulted in healthcare lagging far behind other industries in terms of new technologies.
But I know plenty academic researchers with a "move fast and break things" and "ignore all rules" attitude. In any highly-competitive system there will be those that gain an advantage by being amoral while everyone else follows the rules. Healthcare is probably especially vulnerable to this as the rules (and legitimate companies following them) has resulted in healthcare lagging far behind other industries in terms of new technologies.