[joveian]

But will that actually help? I could easily imagine Facebook matching people who have shared contact numbers, even if the contact number shared is not associated with an account. Possibly they don't do that to try to avoid this situation.

I think this issue requires action from Facebook. The minimum they should do is allow numbers to be registered to be not used for making connections. Much better would be for them to be more explicit about what information they are collecting (with sufficient guidance that the user understands that medical privacy can be affected) and allow users to not send them that information in the first place. I can't imagine them doing that voluntarily, though.