Yeah, I think thats a valid edge case - and a manageable one. If you are expecting a call from a doctor, lift the firewall for a while.
The fix of course is an enforced requirement from higher authority that health care providers communicate only by means that prove identity of the source -- never calling from an unverifiable number.
How to make that happen, though ... ?
That and trying to walk my parents through turning this sort of thing on already was a 3 hour long process. That they will in no way remember even with a checklist.
There is unlikely going to be a technical way to solve this social problem, as is usually the case.