It's the comapny employing nurses receiving the calls.
I guess "phone company" is used here loosely, to describe the provider of VoIP call center and recording service provider employed by the service (which is owned by the municipal/county co-operation organisation SKL, Sveriges Kommuner och Landsting).
Ah that's the reason you exert the maximum pain at a high enough level - then the phone companies will take security properly and enforce it on third parties.
There is nothing a phone company could have done here. They are not liable at all.
If I record a phone call between you and me, then put said recording on pastebin or what not, can you honestly blame your phone company or mine?