After contact tracing data breach, Pa. sidesteps scrutiny on