$2.14 million HIPAA settlement underscores importance of managing security risk