A law firm that represents New York City-area hospitals will pay the state $200,000 in penalties for failing to protect patients' personal and health care data, Attorney General Letitia James said Monday.