Excellus Blue Cross and Blue Shield to pay $5.1M HIPAA penalty