HHS settles data breach investigation