Five Breaches in 2012 Lead to $3.5 Million OCR Settlement