Medical provider phone calls are phish-suspicious as hell.

How many people have experienced this: "I'm calling from $doctor, I need to speak to Jay" "This is he" "What's your last name and date of birth?"

I usually require an innoculous piece of validating info that only they would know, like my PCP's name or a recent addition to my file before I give away PII... but someone in security there needs fix their process and stop training people to give up their birthdate.