This is complex and considering the sensitive nature of the application and the usage “doctor alerts” I would really consider not using a blog platform.
There are a lot of systems out there that support secure sms with options for media.
If you must for some reason use WordPress, to authenticate users have a look at some of the HTTP authentication plugins, OAuth, XML-RPC, or just regular logins with cookie support and a mobile friendly theme.
ps. You cannot get a mobile number unless the user gives it to you.