Record HIPAA settlement could portend tougher privacy enforcement