At a bare minimum I would except the site to default to HTTPS (with no warnings). Got an "Untrusted Connection" when trying to use HTTPS. That's not a good sign if you want people to enter personal medical information.