EyeMed has agreed to pay $2.5 million as a part of this new settlement as well as implement an information security program with requirements and must provide a certification of compliance , regulators are focusing on the security in place at the time of the breach.