The challenge there is ethical vs legal. Since the laws haven't caught up, if you have already established a patient-doctor relationship with the client that found the dog (and that dog) before you establish that your policy is X, you can be violating confidentiality (which there are laws and regulations about.)
Remember that ownership isn't always defined by original owner. I have had this go to court in the opposite way. We had legally adopted an animal from a county shelter. It had been held for two weeks without anyone trying to find it (purebred english bulldog.) It was checked for a microchip at the county shelter. We took it to our vet for routine physical. Two weeks later we get a call from the previous owners, who apparently called all the vet clinics in the area (only 3) and our vet clinic told them we had rescued an English Bulldog and gave our info out. We refused to turn over the dog (he was emaciated, had been left out in 110 degree weather, had sores, and was HW+.) Their excuse for not looking for the dog? They were convinced their neighbor stole it (though they never reported theft either.) The dog also, according to them, routinely broke its chain and wandered the neighborhood. They took us to court, we won. I had already poured money into the animal, started him in obedience training, etc. The judge ruled in our favor, and specifically noted that the release of our information directly to the owners was completly inappropriate, and advised us to write a letter to the state board and the BBB. I opted not to (this was a vet I also worked with every day in a different capacity.)
The vet should have referred the owners to the shelter, who would have contacted us, but would not have released the info. His client/patient relationship with us included not releasing personal information. He not only released our names and numbers, but I was in a public position, and these folks did show up at my work and threatened me with violence. I think that is where vets run into problems, particularly if they don't address this on the initial visit before client/patient privelage attaches.