P2019-ND-004

On January 12, 2018, an unidentified woman contacted the Organization and identified herself as the sister of a client of the Organization. The caller said her sister was in the hospital, and the caller wanted to make a payment on her sister?s behalf. The Organization?s agent had no authorization to provide information to the caller, and did not. On January 24, 2018, the Organization confirmed the client?s address had changed. On January 30, 2018, the Organization?s agent called a reference previously provided by the client (a family member) in an effort to contact the client. During the call, the agent disclosed the information at issue, including that the client was hospitalized. On January 30, 2018, the agent?s supervisor called the client. The client was upset that personal information had been disclosed to the reference by the agent.