The hospital employee failed to keep protected health information secure and violated the patient’s privacy. Unauthorized information concerning the patients’ medical condition and treatment plan were released to an unauthorized contact phone number and person. Applying administrative safeguards to protect the organization's health information covers security objectives, such as confidentiality, which was breached in this particular case. The patient’s privacy rights and HIPAA law were violated because the health care organization provided an unauthorized disclosure and ignored the patient’s specific communication request. The patient had specifically provided an alternative contact number at her work, and the hospital failed to accommodate