Borgess contractor error may have violated HIPAA