I co-taught a 4 hour workshop at the DEFCON hacking conference a couple years ago around this exact topic.

It is amazing how much pager information is still out there and the amount of sensitive information being broadcast. During our live demo/teaching we intercepted pages from numerous Las Vegas hospitals containing what appeared to be HIPPA-protected information, and all sorts of other sensitive and interesting information.

These pages are able to be intercepted far beyond the confines of the hospital as they use the cell network system using paging infrastructure that has been there for a very very long time.

As far as protecting patient data, this shows the complete lack of understanding that these people have about data protection. In a nutshell:

ENCODED DOES NOT MEAN ENCRYPTED

The RadioCommunications Act is crystal clear on this stuff: if you can intercept it, and can decode it, and it's not properly encrypted, you can listen in.

It's why most police departments have gone digital and encrypted.

The onus is on the hospitals to retire their ancient POCSAG/FLEX pager systems and replace them with something else.

This is a North America-wide issue, and if you park yourself in any major metro area, you will undoubtedly find running and active pager networks with all this data flying by.

If anyone is interested in learning how to do this perfectly legal radio scanning hobby, feel free to drop me a line and I can send you the slides from DEFCON.