So, who thought it was a good idea to record these in the first place and then to store them on an internet facing server? It doesn't surprise me one bit though.
Recording the calls could even be a requirement. You call in to get medical advice, then later decide the advice was wrong and sue them for malpractice. Recordings of the calls could be crucial to deciding the case later on.