There are several things to consider. Release of PHI in the course of payment is permitted. An error in release should be followed by 1) notification to the incorrect insurance company regarding the error, 2) request for return of the PHI or assurance the PHI has been destroyed, 3) appropriate log of release of PHI since it was not directly related to payment from the correct payor source. You may want to check with your organization whether you should notify the patient directly or wait for the patient to request access to the release log. We are always liable. However, liability would be directly related to harm the patient incurred as a result of release of PHI. If the error in release did not result in abuse of the PHI or damage I would not be concerned.