NHS vulnerable to health card fraud, government admits