Hospital group pays millions to settle HIPAA case