All-in cost of a HIPAA breach: OCR settlements, breach notification, credit monitoring, lost contracts, and reputational damage.