2. I'm pretty sure they do that for actual callers: However, there are times they call a wife or sibling or child for a patient and they can't verify. Besides, these places DO leave voice mails asking folks to call back. This isn't much different.
Also, this last one could be resolved, but it would take some sort of stronger national digital ID. I have a secure digital mailbox for government stuff. Doctors and hospitals have a different system, but I use the same authentication for both (and payments, actually). This is a greater hurdle than dealing with robocalls, though.