A staffing company that performed COVID-19 contact tracing for Pennsylvania and exposed the private medical information of about 72,000 residents will pay $2.7 million in a settlement with the U.S. Justice Department and a whistleblower