As long as they are digitally storing/processing PII, I would say yes. If they can't reasonably guarantee the security of such information, they should simply shut down their online presence.