You're allowed to assume the phone network is not being eavesdropped, you're not allowed to assume that for Internet transmission. Whether that's true or not, t

You're allowed to assume the phone network is not being eavesdropped, you're not allowed to assume that for Internet transmission. Whether that's true or not, that's the accepted position. If this encryption genuinely allows structural data retrieval - eg common invoice templates or medical reports - then this is absolutely a HIPAA problem, and once a facility is made aware of it they would need to respond. FWIW, this message encryption is also accepted by UK NHS, in fact it's virtually the standard. The mitigating factor is that typically the user is fully authenticated before being allowed to access the encrypted data...