They have insufficient identity verification. Even when a patient hasn't enrolled in the portal, fraudsters can set up a fake account using data obtained via “phishing” emails. The sign-up system has no way of knowing if this is the real person or not. They fail to mask sensitive information.