My opinion is that your health insurance company is not your health care provider. And if they only went by your first name, it is sketch as hell.

I teach an EMR, so I am coming from the medical provider perspective. My curriculum repeatedly emphasizes two additional verifications of identity. Name, DOB, maybe an address or the last four digits of someone's social. Medical record number if they know it, though few people do.