“Having ID.me as our identity proofing layer is essential for protecting PHI.”