I had the opposite in the ER, they gave anything to my wife, which honestly I would have been fine with.
We have the same mailing address, used the same credit card and have the same last name. Thats all I got for you. It failed at reckless human behavior, and a lack of security controls. Epic would have been far safer.
No permission was given either way. Had to be look up via address, credit card or last name? but we dont have that uncommon of a last name ... so that is even scarier.
That requires explicit written consent, which wasn't here.