IT experts allege the health portal ignored warnings about vulnerabilities for years - but the regulatory vacuum meant the company was not required to take action.