Vancouver Coastal Health claims they "have no information to suggest private patient information has been used in any malicious way", which is a very disingenuous statement to make, because there's no conceivable way for them to know who has received radio transmissions or made use of such data maliciously. To be frank, I find this pretty mind-blowing and it's disappointing that even in the face of press/public attention, it's not being remedied.
[0] https://openprivacy.ca/blog/2019/09/09/open-privacy-discover...
[1] https://www.ctvnews.ca/health/pager-systems-used-in-healthca...
[2] https://openprivacy.ca/blog/2019/09/26/pager-breach-update/
That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical.
… Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.
[0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials...
Source: https://www.fcc.gov/consumers/guides/interception-and-divulg... via https://www.reddit.com/r/RTLSDR/comments/4nhg7h/legalities_o...
The text messages that float about in the ether these days aren’t messages between individuals, they’re monitoring alerts (refrigeration systems, computers), and medical (doctors being paged, order to clean hospital rooms, calls for medical transport). That’s the case at least here in my medium-sized town in the US Midwest. It could be very different elsewhere.