is it hippa violation to give patient info over the phone to another medical entity