How do we possibly close this loophole?

I work for a medical company providing free medication to patients who apply and qualify for it. One big HIPAA regulations we have to follow with any patient is that they can list on their application the name of a contact who they want to have access to their account or records. Typically it's a spouse, child, parent, sibling, friend, etc. Just someone they designate who can call in on their behalf. As long as their name is on the app we can release info to them. A lot of the patient work with patient advocacy groups who do a lot of stuff for them and they will list the advocacy group as their contact, but we still need a person's name. Lately I've noticed that one particular advocacy group will only use one name on the patient's applications and everyone who calls in will give the same name. In the morning I'll get a call from a guy obviously white, saying his name is Alex Williams, and we discuss the account. Around lunch I'll get another call from another Alex Williams and this person will have a heavy Hispanic accent. Later in the day a 3rd call will come in from a woman claiming to be Alex Williams. I guess with Alex being a unisex name they were not expecting to get the same rep 3 different times. When I asked one of them about this they told me that that's the name they use for all their employees so they don't have to give their actual names and they don't have to list different people on the applications. I can't see how this is legal. I personally think this is a big violation of the HIPAA guidelines. In speaking with a few employees and our manager one person stated that if they put their name as Felix The Cat on the app and identify themselves as Felix The Cat then we have to release whatever info they request. I just can't see how this is legal.