Health plan pays for failing to erase data on leased equipment: two takeaways for companies handling electronic PHI