Confidential health information was sent to a patient's employer by a physician, resulting in a HIPAA violation.