A patient calls to say they cannot access their portal account after three failed login attempts.What is the most appropriate first step?