A healthcare firm has agreed to shell out millions of dollars to settle a class action lawsuit over a data breach that exposed patients’ sensitive information.