I doubt he gave permission.
It’s not an opt in. It’s an opt out.
If the patient does not object after being informed, the limited directory information can be shared with callers/visitors who ask by name.
Someone was sloppy.