> One of the applications I'm talking about is a physician portal meant specifically to be used over the public internet.

Ouch. That just screams 'this company doesn't understand security at all'.