The MMG Fusion HIPAA settlement exposed 15M records for a $10,000 fine — what it means for healthcare vendors and business-associate breach risk.