Exactly the point in the conversation... in this case it's a webform to notify directly.. I think a simple password prompt and including an actual list of emergency contacts would be prudent.