It is also poor security practices by the company.
At a truly secure call center, employees enter the work area without any pencils, pens, paper, or electronic devices. They use a secured, locked-down computer to transact business where every transaction is completely logged. The only thing they could do is try to memorize a few SSNs.
Again I think the security of American's personal information was the last thing on the O'Care administrators minds.