Patient portals
Patient portal development: what the EHR will and will not expose
Hashlogics builds patient portals on Epic, athenahealth or eClinicalWorks from the data each EHR exposes, and says when the EHR's own portal is better.
- 4.8 on Clutch across 22 reviews
- PremiumAudit.io: audit cycle cut 75%, calculation errors cut 95%
- In production for SmartREI, Tankaware, ZyloBase, KiwiWrite
Four things to know before you build a portal
4 things that decide this
- 01A custom patient portal can only show and change what your EHR exposes to a third party, so the first job is to map that for your setup.
- 02Reading is usually easier than writing. Your EHR's FHIR R4 API often exposes results, medications, allergies and visits; booking, forms and messages that write back depend on the vendor and your settings.
- 03If your clinic runs Epic and patients already use MyChart, a custom portal rarely replaces it. It sits beside it for the jobs MyChart doesn't do the way you need.
- 04Proxy access for parents and carers, and privacy for teenagers, are rules you write first and code second.
Who builds custom patient portals for clinics?
Hashlogics builds custom patient portals for medical clinics, behavioral health practices and telehealth providers that run Epic, athenahealth, eClinicalWorks or another EHR. We start by mapping what your EHR lets a third-party app read and write. Then we build the screens your patients need on top of that: booking, intake forms, secure messages, results and payments.
We also tell you when not to build. If the EHR's own portal covers your patients' needs, the honest answer is to configure it well and spend your budget elsewhere.
What can a custom portal read and write in each EHR?
This is the usual pattern, not a promise. What you get depends on your EHR version, the modules you license and your organisation's settings, so we confirm it for your setup in the Blueprint.
| Job | Read from the EHR | Write back to the EHR |
|---|---|---|
| Results, medications, allergies | Usually, through the FHIR R4 patient-access APIs. | Rarely. These stay owned by the clinician. |
| Appointments | Usually: upcoming and past visits. | Sometimes, through vendor scheduling APIs; otherwise a request a staff member confirms. |
| Intake forms and questionnaires | Partly: what was filed before. | Sometimes as a questionnaire response or a document; otherwise a staff-accept queue. |
| Secure messages | Depends on the vendor and your setup. | Often only through the vendor's own messaging, so many custom portals run their own and file a copy. |
| Demographics and insurance | Usually. | Updates often go to staff to accept, so bad data doesn't reach the chart. |
When should you keep MyChart or the vendor portal?
Keep Epic MyChart, the athenahealth patient portal or the eClinicalWorks portal when your patients mainly need to see results, message the care team and pay a bill. Those portals are tied into the EHR in ways no third party can match, and your patients may already use them with other providers.
Build when the job is specific to your practice: a behavioral health intake that runs over several sessions, a program with its own consent steps, a telehealth flow that starts before the patient exists in the EHR, or a portal for a product you sell to many clinics. In those cases a custom portal sits beside the vendor portal, and you link between the two.
If your clinic is part of an Epic health system, we won't promise to replace MyChart. We'll tell you which jobs a custom layer can take and which stay in MyChart.
How do proxy and minor accounts work?
Every portal needs to answer three questions before any screen is drawn. Who is this person? Whose records can they see? What changes when a child turns a certain age?
Identity starts with sign-up checks you choose, such as matching date of birth and a code sent to a phone on file. Proxy access lets a parent, carer or guardian act for someone else, and each proxy link is a record with a start, an end and a reason. Teenagers are the hard case: state laws let minors consent to some care on their own, and a parent proxy shouldn't see those notes. We write the rules for your states with your compliance lead, then build them as permissions the system checks on every request.
- 01Sign-up identity checks you choose
- 02Proxy links with a start date, end date and reason
- 03Age-based rules that change what a parent proxy can see
- 04Every access checked on the server, never just hidden on screen
How do secure messaging and audit work?
Secure messages stay inside the portal; the patient gets a notice by text or email through Twilio that a message is waiting, with no health details in the notice itself. Staff answer from a shared inbox with owners and response times, and a copy of each thread is filed to the chart where your EHR accepts it.
Every view and change is logged: who opened which record, when, and from where. That audit trail is what you show when a patient asks who looked at their file.
Is a custom patient portal HIPAA compliant?
No software is HIPAA compliant on its own. HIPAA applies to your clinic and to each business associate, and the portal is built to support the safeguards you need: business associate agreements with every vendor in the chain, encryption in transit and at rest, access checked by role, and an audit trail. We list the vendor chain and each one's BAA status in the Blueprint.
What have we built that looks like this?
Algoricum is a patient-acquisition platform for clinics that we built. It pulls patient inquiries from 11 sources into one pipeline, and a trained assistant texts and emails each one until it books. That's the same messaging plumbing a portal needs: queues, per-clinic sending domains and a sequence that stops the second a patient answers.
TrialTriage, an oncology platform we built, has separate roles for admins, nurses, patients and insurers, and was built HIPAA-aligned with full audit trails. Every match goes through a nurse before it counts.
Patient messaging and role-based records we have shipped
What does the first step look like?
Start with a 45-minute call with an engineer. Bring your EHR, the portal you use today and the three jobs patients complain about most. The next step is a fixed-fee Blueprint, credited in full against the build: a map of what your EHR exposes, the build-or-keep answer for each job, and a fixed price per milestone. If the plan isn't one you'd act on, you don't pay for it.
Questions clinics ask about patient portals
01Who builds custom patient portals for clinics?+
Hashlogics builds custom patient portals on top of Epic, athenahealth, eClinicalWorks or the EHR you run. We map what your EHR lets a third party read and write, build booking, forms, messages and results on top of it, and say plainly when the EHR's own portal is the better choice.
02Can a custom portal replace MyChart?+
For most clinics on Epic, no, and we won't promise it. MyChart is tied into Epic in ways a third party can't match. A custom portal can sit beside it for jobs specific to your practice, with links between the two.
03What can a portal write back to the EHR?+
Appointment requests, questionnaire responses and documents can often be written back, depending on your EHR, its version and your settings; results and medications stay with the clinician. Where a write isn't open, the portal sends it to a staff queue to accept.
04How do proxy and minor accounts work?+
Each proxy link is a record with a start, an end and a reason. Rules by age change what a parent can see, because state laws let minors consent to some care alone. We write the rules with your compliance lead and check them on every request.
05Is a custom portal HIPAA compliant?+
No software is compliant on its own; HIPAA applies to your clinic and its business associates. We build the portal to support the safeguards: BAAs across the vendor chain, encryption, role-based access and a full audit trail.
Go deeper
- Healthcare hub →Everything we build for clinics and care providers.
- EHR integration →What Epic, athenahealth and eClinicalWorks let a third party read and write.
- Medical clinic software →Custom software for the front desk, intake and follow-up.
- Epic integration: what a real build involves →Access, sandbox, FHIR and the parts that take longest.
- Behavioral health software →Intake, consent and records for behavioral health practices.
