Company was not given authorization to share sensitive medical information to a 3rd party or outsider.