A US healthcare firm has agreed to pay out millions of dollars to settle a class action lawsuit filed over a data breach.