Your brain short circuits at sarcasm, so Im not really expecting much from it.

If you are already giving valued medical data to someone, the simple act of checking the ip of login and sending a "was this you?" email isnt even remotely the level of data loss you want to pretend it is.

Its common sense to protect your user, and your database, from phishing. If you want to genuinely claim that phishing protections for medical data is bad, by all means. You already sound like a fool, may as well set the stone.