Today, the use of information systems in healthcare has dramatically increased. Some health insurance companies use WWW for patient operations such as opening patient consultation, prescription etc. From the security point of view, generally simple security is applied in order to identify patients and physicians. The lack of security results in exploitation of insurance companies by some of patients and physicians. In this paper, we have examined the current web-based healthcare insurance systems and purposed security architecture to solve security problems. The security architecture highly depends on patient and physician smart cards and fingerprint-based biometrics.