How spam and scam calls are disrupting healthcare across the United States and Canada — the patient safety threat, the privacy risk, and the market opportunity for infrastructure-level defense.
For most businesses, spam calls are a nuisance. For hospitals and medical clinics, they are a life-or-death disruption. The Washington Post called it "a new kind of health crisis." The FCC commissioned a dedicated report on the problem. The American Hospital Association issued a December 2025 alert warning hospitals to brace for an escalating wave of deepfake voice scams.
Hospitals have reported receiving 4,500 scam calls in a single 2-hour window — overwhelming switchboards and blocking legitimate calls from patients and emergency responders. Telephony Denial of Service (TDoS) attacks use spoofed numbers to flood hospital phone lines with hundreds or thousands of calls, effectively shutting down incoming and outgoing lines — including emergency lines.
Scammers are calling directly into patient rooms — selling insurance and running fraud schemes on vulnerable, hospitalized individuals. Nursing care is being compromised. The Hospital Robocall Protection Group reported that unwanted calls to hospital phone systems can disrupt patient care services and pose a direct threat to public health and safety.
Unwanted calls are the FCC's number one consumer complaint. For physician practices and clinics, these calls disrupt scheduling, block appointment lines, waste clinical staff time, and erode patient trust in the healthcare organization's phone system.
The problem is not improving. Spam call volume increased 20-33% year-over-year in 2025, reaching a 6-year high. 52.5 billion robocalls reached US consumers in 2025. And the number of phone companies that have fully implemented robocall-fighting technology has actually dropped in the last year.
| Facility Type | United States | Canada |
|---|---|---|
| Hospitals | ~6,100 | ~1,400 |
| Physician Offices & Clinics | ~230,000 | ~48,000 |
| Total Healthcare Locations | ~236,000+ | ~49,000+ |
Every one of these locations operates phone systems that are receiving spam calls daily. Every one operates under strict privacy regulations (HIPAA in the US, PIPEDA/PHIPA in Canada).
Healthcare is the most regulated and most targeted industry for data breaches — and has been the costliest industry for breaches for 12 consecutive years. The phone is increasingly the entry point for attacks that result in massive patient data exposure.
Vishing (voice phishing) attacks use phone calls to deceive healthcare staff into revealing patient data, credentials, or financial information. In 2025, a large California hospital system reported an attempted attack where a voice clone of the CFO requested a wire transfer from the finance department. Phishing scams are spoofing hospital PBX systems, using fake voicemail notifications to lure remote healthcare workers into divulging credentials.
1 in 3 people has received a deepfake call (Hiya, 2026). These AI-generated voice scams are now specifically targeting healthcare organizations — impersonating executives, vendors, and partners.
IBM/Ponemon 2025. Healthcare remains the most expensive industry for data breaches. A single phishing-initiated breach can trigger HIPAA penalties of up to $2 million per category — on top of remediation, legal, and notification costs.
HHS Office for Civil Rights settled a HIPAA violation with PIH Health for a phishing attack that exposed unsecured electronic Protected Health Information. A single phishing attack. One settlement. $600,000.
| Segment | 2025 | 2030-2035 | CAGR |
|---|---|---|---|
| Robocall Mitigation (Global) | $5.6B | $21.1B (2035) | 14.2% |
| Robocall Mitigation (North America) | $5.1B | ~$12-14B (2033) | 21.1% |
| Anti-Spam Software (Global) | ~$7B | $22B (2030) | 21.6% |
The FCC removed over 1,200 voice service providers from telephone networks in 2025. STIR/SHAKEN mandates are expanding. The regulatory environment is tightening — creating both compliance pressure and market opportunity.
43% of spam traffic now carries A-level STIR/SHAKEN attestation (TNS, 2025) — meaning it passes through existing carrier-level filters undetected. The current mitigation infrastructure is failing. Healthcare organizations need infrastructure-level solutions, not application-layer band-aids.
Hospitals must answer every call — lives depend on it. This makes them the perfect target for spam, social engineering, and TDoS attacks.
Clinical and administrative staff are conditioned to assist callers, making them more susceptible to vishing attacks than employees in any other industry.
A single healthcare record sells for $250-$1,000 on the dark web — 10 to 40 times more than a credit card number.
HIPAA violations can result in fines up to $2 million per category. A single phishing-initiated breach can cost $7-10 million in total impact.
Many hospitals run aging PBX infrastructure with minimal spam filtering — making them easy targets for TDoS attacks and spoofed calls.
The American Hospital Association warned in December 2025 that AI-generated voice scams are escalating in both frequency and sophistication against healthcare organizations.