Health systems & hospitals
Enterprise portals unifying records, results, and messaging across service lines.
Patient Portal Development
Patient Portal
We build patient portals on the FHIR Patient Access API and SMART on FHIR, so patients securely reach their records, results, and care team, and you meet 21st Century Cures information-sharing rules.
HIPAA-ReadyFHIR R4SMART on FHIRCures Act
Trusted by global innovators
What is a patient portal?
A patient portal is a secure website or app where patients see their records, results, medications, visit summaries and bills, and message their care team. Agnotic Technologies builds patient portals on HL7 FHIR APIs and SMART on FHIR, with identity proofing, audit logging, WCAG 2.2 accessibility and HIPAA safeguards designed in.
Certified EHRs must offer a standardized FHIR API under ONC criterion 170.315(g)(10), so a modern portal reads live data from FHIR rather than a proprietary feed.
We build portals that are fast on any device and let patients connect the apps they choose.
What it is
What does a patient portal give patients?
Patient portal development builds the secure web and mobile experience where patients access records, results, messaging, scheduling, and bills. Under the 21st Century Cures Act, that access must be standards-based, which makes the FHIR Patient Access API and SMART on FHIR the modern foundation.
We build portals on those standards so data is live, patients control which apps connect, and the experience is fast and accessible, meeting the rules and earning real engagement.
How does a patient portal connect to the EHR?
A portal architecture built on the FHIR Patient Access API and SMART on FHIR authorization: live data from the record, patient-controlled access.
What goes into a patient portal?
A compliant, standards-based portal that patients actually use: data live from the record, access in the patient's control.
FHIR Patient Access API
The portal reads from the FHIR Patient Access API using FHIR R4 resources (Patient, Observation, DocumentReference, MedicationRequest, DiagnosticReport), so patients see live data and you satisfy the Cures Act patient-access requirement.
SMART on FHIR Authorization
OAuth2-based SMART on FHIR launch and scopes let patients securely authorize the portal and any third-party health apps they choose, with granular, revocable consent, no shared credentials.
Results, Records & Summaries
Lab results with LOINC-coded reference ranges, visit summaries, problem and medication lists, immunizations, and C-CDA document download, presented in plain language patients can understand.
Secure Messaging & Assistance
HIPAA-compliant patient-provider messaging with optional AI-assisted plain-language explanations of results and instructions, always with clinician oversight of clinical content.
Scheduling, Bills & Forms
Online appointment booking, intake and consent forms, and bill pay, integrated with your practice-management and EHR systems so actions flow both ways.
Identity, Consent & Audit
Identity proofing, proxy/caregiver access, granular consent, and immutable audit logging of every record view, engineered to HIPAA and Cures Act information-blocking rules.
Where it fits
Who needs a custom patient portal?
Providers who need Cures Act compliance and a portal patients will actually use.
Specialty & multi-site groups
Branded portals tailored to specialty workflows and multiple locations.
Digital health platforms
Products embedding patient access via SMART on FHIR into their own experience.
Practices replacing legacy portals
Groups moving off clunky, low-adoption portals onto modern FHIR-based ones.
Value-based care organizations
Portals that drive engagement in care plans and preventive outreach.
Payers & TPAs
Member portals surfacing claims, benefits, and care resources.
How does a portal meet Cures Act rules and keep patients using it?
Compliance is table stakes; adoption is the goal. We build portals that satisfy the Cures Act and that patients return to.
FHIR
Patient Access API, live from the record
SMART
OAuth2 patient-controlled app authorization
WCAG 2.2
Accessible on every device
Compliance-First Healthcare App Development Services Backed by Global Standards
15-Minute Scoping Call01
HIPAA
Health Insurance Portability and Accountability Act
Protect PHI with privacy-first architecture, encrypted storage and transmission, strict access controls, and traceable audit logs.
02
GDPR
General Data Protection Regulation
Implement lawful consent flows, data minimization, retention controls, and secure processing for sensitive health data.
03
FHIR
Fast Healthcare Interoperability Resources
Enable standardized health data exchange across apps, care teams, and systems through standards-based FHIR APIs.
04
HL7
Health Level Seven International
Support enterprise-grade interoperability with HL7-based integrations for records, events, and clinical messaging workflows.
05
HITRUST
Health Information Trust Alliance
Align security programs to healthcare-specific control and risk management practices trusted by providers and ecosystem partners.
06
HITECH
Health Information Technology for Economic and Clinical Health Act
Design with breach notification readiness, digital record safeguards, and operational controls that support regulated care programs.
07
SaMD
FDA Software as a Medical Device
Plan software quality, traceability, and documentation pathways for products that may require SaMD review and submission.
08
MDR (EU)
Medical Device Regulation (European Union)
Prepare EU market-ready processes for risk classification, evidence tracking, and lifecycle governance under MDR expectations.
09
SAMHSA
Substance Abuse and Mental Health Services Administration
Apply confidentiality controls and consent-aware sharing models for behavioral and mental health data experiences.
Standards and compliance
Which standards does the portal build on?
FHIRSMARTUSCDILOINCCuresHIPAA
Our Process
How do we ship a patient portal?
We build the compliant data foundation first, then the experience, so the portal is both standards-correct and genuinely usable.
1.
Discovery & Access Design
We map the data patients need, your source systems, and the SMART on FHIR authorization model, then design the portal's information architecture.
Cures-Act aligned
2.
FHIR Data Layer
We connect the FHIR Patient Access API and map resources to portal views, with SMART on FHIR OAuth2 scopes and consent handling.
Live from the record
3.
Experience & Integrations
We build the responsive patient experience (results, messaging, scheduling, and bill pay) integrated with EHR and practice-management systems.
Patient-first UX
4.
Launch & Adoption
Phased go-live with identity proofing, accessibility checks, and analytics to drive real patient adoption and support.
Built for adoption
Facts and sources
Which rules shape a patient portal?
Short facts we design around, each linked to its primary source.
ONC certification criterion 170.315(g)(10) requires certified EHRs to offer a standardized API for patient and population services based on HL7 FHIR.
Source: 45 CFR 170.315 (eCFR)The information blocking regulations restrict practices by health care providers, certified health IT developers and health information networks that interfere with access, exchange or use of electronic health information.
Source: 45 CFR Part 171 (eCFR)WCAG 2.2 is the W3C Recommendation commonly used as the technical benchmark for accessible web and mobile interfaces.
Source: W3CThe HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information.
Source: 45 CFR Part 164 Subpart C (eCFR)
Featured case study
Read Case StudyLera Health: compliant women's health platform
Related proof of compliant patient-facing delivery: for Lera Health we built a privacy-first patient experience and data layer end to end. It shows the consent, PHI handling, and UX craft a patient portal demands, though it is a distinct product.
Why Partner With Us
15-Minute Scoping CallWhy build your portal with Agnotic?
We build portals that meet the Cures Act and that patients actually open: standards-correct and human-friendly.
Standards-Correct by Default
FHIR Patient Access API and SMART on FHIR built in, so Cures Act access rules are met without workarounds.
Patient-Centered UX
Plain-language results and accessible, mobile-first design so patients engage instead of abandoning the login.
Integrated, Not Bolted-On
Scheduling, messaging, and bill pay wired into your EHR and PM systems so actions actually take effect.
Healthcare Domain Depth
We know FHIR, consent, and information-blocking rules cold, so compliance is handled without slowing delivery.
Our relevant experience
Compliant patient access patients actually use
Frequently Asked Questions
Yes. Portals handle protected health information, so Agnotic signs a business associate agreement before any PHI is shared with our team.
Cost depends on how many features and integrations you need: a read-only records-and-results portal is far cheaper than one with messaging, scheduling, and bill pay wired into your EHR and PM systems. We scope in phases and give a fixed estimate, so you can launch core patient access first and expand.
It depends on features and integrations. We connect the FHIR API and core record views first, then add messaging, scheduling and payments in later phases, and give you a timeline after the scoping call.
If your EHR's portal meets your needs and patients use it, keep it. Build custom when you need your own branding, a better patient experience, features your EHR lacks, or a portal that spans multiple systems. Because we build on the FHIR Patient Access API, a custom portal can read from your existing EHR rather than replace it.
We connect to your EHR's FHIR Patient Access API using SMART on FHIR authorization, reading live FHIR R4 resources for records, results, and medications. Write actions like scheduling and messaging integrate through the EHR's and practice-management APIs.
Building on standards-based FHIR APIs and SMART on FHIR is what those rules expect. We implement standards-based access, patient-authorized third-party app connections and data release that avoids information blocking.
We implement identity proofing, encryption, role-based and proxy access, granular consent and immutable audit logging to the HIPAA Security Rule, designed in from the first sprint.
Yes. We scope the first release to one workflow, such as records and results read live through the FHIR Patient Access API, and put it in front of real patients. Messaging, scheduling and bill pay follow in later releases once the first one is in use.
AI tools help our engineers draft code and tests, but a person reviews every change, and it passes the same automated tests, accessibility checks and security checks as any other portal code. Which tools may see your code or data is agreed with you at the start.
Ready for a portal patients actually use?
Tell us your source systems and the experience you want. We'll return a plan built on the FHIR Patient Access API and SMART on FHIR, compliant with the Cures Act.
contact@agnotic.com
Partnerships
contact@agnotic.com