The breach, which UCLA Health disclosed in May 2015, ended up affecting 4.5 million people. The settlement includes $2 million to reimburse victims for the cost of protecting their identities and $5.5 million to establish a fund to bolster UCLA Health’s cybersecurity.