The insurance company did not follow the HIPPA law regarding patient privacy by notifying the (policyholder) mother, not notifying the patient (daughter).  Unless the notification was addressed to the daughter and the mother opened it anyway or the daughter gave permission for her mother to receive the info.