is it hipaa violation to give patient info over the phone to another medical entity