$2.5 million settlement shows that not understanding HIPAA requirements creates risk