The University of Rochester Medical Center agreed to pay 3 million to the HHS Office for Civil Rights and take substantial corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules.