Yep. That was probably about COVID. Health privacy laws prohibit even the vague mention of a condition. The caller has no way of knowing if they have the right phone number, and the last thing you want is "Attention, Rando McUltrarunner at 42 Crustacean Crest Drive, Cleveland, Ohio! You have been infected with COVID! Run, don't walk to your nearest testing facility!" on some stranger's voicemail. Or worse, "We are following up to see if you're doing well after your abortion" ending up on the voicemail or texting app of a 15-year-old girl whose parents might have access to her phone.
Source: Recently completed my company's mandatory annual HIPAA training.
It's not IT-grade authentication, but for wetware it works.
Your doctor's office can do it because you probably have an existing patient relationship, and you already filled out that paperwork on your first visit.
But in the situation of a cold-calling contact tracer, you haven't signed anything at all, so all they can say is "This is the health department and we want to talk to you."
I'm now wondering if it was an attempt at contact tracing. Had they simply stated what they wanted in the message I would have been pretty likely to call them back myself or answer a later call.
I have no idea where they got my cell phone number from, but the whole thing seems poorly handled at best. Anyone with legitimate business will state the nature of that business and allow for a return call. There's just so many solutions to this problem but nearly zero aligned with incentives.