In one project, protected health information was shared with non-VA investigators without proper approval, a new report states.