is it a hipaa violation to send billing info to wrong hmo