N.Y. health plan to pay $5M to settle Med ID data breach case