NY law firm pays $200K over healthcare data security failures