HIPAA is very strict about that stuff. A service provider could be out of business immediately for a violation of privacy.
The phones are another matter.
Years ago my sister was diagnosed with breast cancer. She asked all of us not to say anything to anyone - but one sister wanted information (while keeping her word) and called the American Cancer Society pretending to have cancer herself. The women who answered her questions kept asking for her name and address to send additional information.
Long story short a few weeks after the call the sister who never had cancer received ads for miracle cancer cures from quacks in Mexico. The sister who had cancer died within two years when she was 39 years old. Lots of bad people in the world. Good people too... Nice to hear that HIPAA is strict about privacy - I wish them the best in that effort..