A report found two years of missing measures and undefined fiscal 2026 goals for the health records’ interagency cybersecurity and privacy protections.