The patient portal includes detailed patient information and patient records.
This email was sent after I clicked a password recovery link, not at registration. Clearly they are storing the passwords in a plain text accessible way long term.
I opened a discussion with them, and they dismissed me outright, maintaining that there is no problem with the way they are storing passwords. To be so lax about a login portal that contains sensitive, legally protected medical information is mind-boggling.