[mertcelebi]

In addition to identity verification, there are two more things we do to protect the privacy of our patients!

1) If the electronic signature on a given request doesn't match the name of the patient, we make sure that the patients are who they say they are before moving on with gathering the medical records.

2) If one tries to sign up on behalf of another patient, we require a Power of Attorney (POA) document!

Hope this answers your question!

[kaybe]

1) What are you using to create the signature? How can you guarantee that the attacker can't create the matching signature?

2) How do you know they're trying to do that if they don't tell you? Your scenario looks like a regular situation, not an attack..