University of Texas MD Anderson Cancer Center must pay $4.3 million in civil penalty to the federal Office of Civil Rights for HIPAA violations stemming from data breaches in 2012 and 2013.