Did she at least try contacting you first? And did she use your name with your friend's H? If so, I think that's a violation of HIPAA privacy laws, if you didn't have him listed as an emergency contact and grant written permission to contact him. Actually, if you don't have the friend listed, that could be a violation, too.