Health data breaches rise but fines rare