HIPAA-Compliant Portals for Doctors and Patients

Of course, doctor-patient portals contain a vast amount of patient data and must be HIPAA-compliant. Keeping ePHI safe can be a complex process that should be tackled by a vendor with extensive experience in the field.

Patient portals are often a part of a HIPAA-compliant website, and each must secure electronic protected health information (ePHI) at every step with encryption and tokenization. Let’s look at the kind of data being protected, who’s using the portals, and what they can do.

Who’s Using HIPAA-Compliant Portals?

While often called “doctor-patient portals,” doctors and patients aren’t the only ones who can interact with a HIPAA-compliant portal. Here are the most common ways that such a portal is used.

• Doctors – Doctors will have access to the most information on a HIPAA-compliant patient portal. They can choose any patient in their care and drill down into their history, including labs, prescriptions, and diagnoses from other doctors.
• Patients – While doctors might have access to more information and the ePHI for multiple patients, a patient might spend as much time on the portal going over their own files. For instance, a doctor might skim a patient’s results and know what’s wrong in a few seconds. A patient is more likely to delve deep into every lab diagnostic number and look up what each means.
• Labs and Imaging – Labs and imaging are commonly a “one-way street” on a patient portal. They will deliver results from the procedure and most times will not need any response from a doctor.
• Pharmacies – Pharmacies can also be a significant part of doctor/patient portals. Unlike labs, pharmacies are looking for a response from the doctor, usually in the form of an eSignature.

Excellent Design

The better the design, the more a person—whether patient or doctor—will want to interact with it. Information should be easy to find, and the design must be intuitive. Alerts are another common feature, guiding end-user's eyes to tasks that need attention. The information must be organized to be so simple that it doesn’t distract the end-user. Every option should be intuitive with any HIPAA-compliant telemedicine software you use.

Self-Service

A primary goal of a patient/doctor portal is the ability to self-serve. This often means delivering a simple but robust means of finding information, such as the design we mentioned above.

Self-service is an option that most patients and doctors prefer. The patient can peruse files as much as they want, and the doctor doesn’t have to go searching for information—both information their office created and information delivered by exterior sources—in multiple locations.

Back-Office Connectivity

The ease of connectivity with other software and platforms plays a big part in how successful a HIPAA-compliant portal will be. Common connections include ERP, CRM, API, and other back-office software.

Device Connectivity

Wearable devices that gather health information are more common than ever. Not only can the portal let the doctor approve the prescription for the device in the first place, but the doctor can also monitor a patient’s health via the portal's connection to a HIPAA-compliant medical app.

A common example is a wearable glucose meter. The patient can check in daily to view their real-time numbers, but a doctor can check in occasionally to get aggregated information. This is often delivered in easy-to-absorb pie or bar charts.

Notifications

In addition to the appointment notifications mentioned above, doctors can also get notifications regarding the alerts they need to attend to on the site. For instance, a doctor can decide, “I want a single email per day that reminds me to log into the portal and approve prescription requests.”

Patient Information

• See a simplified list of all patients
• Sort patients by type (adult/pediatric, type 1/type 2 diabetes, mental/physical diagnoses)
• Review information before making it available to the patient
• Interact with patients directly via HIPAA-compliant messaging
• See patient prescriptions
• Access patient labs
• Review medical history and diagnoses
• Investigate demographics (height, age, weight, etc.)
• Remove patients from the system

Scheduling

• Schedule, reschedule, or cancel appointments
• Set available and blackout times/dates for appointments
• Differentiate when they’re available for in-person or telehealth appointments

Pharmacy Prescriptions

• Send prescriptions directly to the pharmacy
• Approve prescription requests that have come from pharmacies (often online pharmacies)
• Set expiration dates and number of refills on a per-prescription basis

What Patients Will See

While doctors will be dealing with information from dozens—or even hundreds—of patients, a patient is limited to their own ePHI data. But because it’s their own health, any data that arrives is extremely important to them.

On an individual basis, patients will have access to nearly all the information that the doctor will have (though doctors can choose to review results before making them available to a patient). Depending on the choices made during portal integration with your medical website, patients can use HIPAA telemedicine apps to:

• Access information – Review files, looks at device readings, see labs
• Schedule Appointments – Interact with the doctor’s scheduling software to make, change, or cancel appointments
• Enter Information – Fill out forms, supply insurance information
• Contact Physicians – Send encrypted messages within the portal to healthcare providers

Work with Clarity

Clarity has extensive experience creating new portals and performing portal integration with older systems. This experience can help you avoid many of the problems that we’ve already solved over the last decade.

Our website is filled with dozens of articles that can help with every stage of creating HIPAA-compliant websites, portals, and healthcare apps for mobile phones, tablets, and kiosks. These are synchronized and secure to give healthcare providers and their patients a smooth omnichannel experience. We offer a complimentary discovery process to help you plan your future, and you can use this plan with us or take it to a vendor that better matches your needs to maintain patient portal HIPAA compliance. Tell us what you need, and we’ll let you know how to make it happen.