Vulnerable portals can expose PHI to application attacks, including SQL injection and cross-site scripting (XSS) and should be protected by a firewall. Suspicious access to PHI stored in files and databases should be alerted or blocked.