4 Features Every Patient Portal Needs to Be HIPAA Compliant

A patient is handed a slip with a portal URL and an activation code. She tries it that night, forgets the password by Thursday, and calls the front desk instead.

Multiply that by every new patient this month. The portal is compliant and almost nobody is in it. Compliance and use pull in different directions, and most buying guides only cover one of them.

Our position: the four features below are the right list. The hard part is building them so people still log in. What follows: what the rule asks of each, what is changing, and where a portal stops being right.

Automated Portal Sign-Up Process

Enrollment is where a portal lives or dies, and the numbers on that are federal rather than vendor.

What the Current Data Shows

In 2024, 77% of individuals were offered online access to their records. Of everyone surveyed, 65% were offered access and used it at least once.

That leaves 13% who were handed a portal and never opened it. The gap is not technical.

The strongest lever is a person. ASTP data on patient portal access shows 87% of people encouraged by their provider logged in. For those not encouraged it was 57%.

Designing Sign-Up for the Rule and the Patient

Under 45 CFR 164.312, unique user identification is a required specification. Person or entity authentication is a standard of its own. The section names no sign-up method.

Text the invitation to a number already in the chart. Verify against something the patient knows. Let them set a password on the phone in their hand.

Secure Messaging

Messaging is the feature patients use most and the one they abandon first.

What Makes Portal Messaging Compliant

Secure instant messaging keeps protected health information inside an access-controlled system with an audit trail. Standard SMS does neither. Most practices keep clinical content out of it for that reason.

The audit trail matters as much as the encryption. An investigator asks who opened a message and when, and a portal can answer that.

When the Login Is the Problem

A secure message nobody reads protects nothing. If a patient will not log in, the clinical value of the thread is zero.

Practices using HIPAA texting without a portal or app download in athenahealth send a text that opens a secure page. The security sits in the link rather than the login.

Clinics running two-way HIPAA texting in the CharmHealth workflow keep the conversation threaded to the chart. Staff answer in writing, and the history stays where an audit can find it.

Multilayer Verification

Authentication is the one item on this list where the rule is about to get stricter.

What Is Required Today

Person or entity authentication is a standard under section 164.312. The text calls for procedures to verify that whoever seeks access is who they claim. It names no method.

Audit controls sit in the same section, alongside unique user identification. Both are listed without a named technology.

What the Proposed Rule Would Add

HHS published a proposed Security Rule update on January 6, 2025. Comments closed that March.

HHS proposed requiring multi-factor authentication, with limited exceptions. The proposal also adds duties to inventory technology assets and map where patient data moves. Retrofitting login flows is the slow kind of project.

Pick factors patients can actually use. A code to the phone already on file beats an authenticator app for a 78 year old.

End-to-end Encryption

End-to-end encryption and the encryption named in the Security Rule are two different things. The difference is worth knowing before a vendor quotes it at you.

What the Rule Says, and What It Does Not

Section 164.312 lists encryption twice, once under access control and once under transmission security. Both are marked addressable rather than required.

HHS describes an addressable item as one you weigh, then adopt if it fits. If it does not fit, you write down why and put an equal measure in place. End-to-end encryption, where only the two ends can decrypt, is a stricter design the section does not name.

Addressable is not the same as optional. The regulation pairs the choice with a documentation step.

What to Ask a Vendor

Ask where the keys live. Find out whether data is locked at rest as well as in transit. Check that they will sign a business associate agreement. Practices weighing HIPAA compliant texting in DrChrono should ask the same three questions.

Why Should HIPAA Compliance Be a Priority?

The penalty figures on most portal articles, this one included until now, are a decade out of date.

What a Violation Actually Costs

This page used to cite $50,000 per violation and $1.5 million for repeat offenders. Those are the pre-2015 numbers.

Amounts were adjusted again on January 28, 2026. OCR applies four tiers by culpability, each with its own yearly cap.

The 2026 penalty adjustment moves these every January. The bottom tier applies where willful neglect went uncorrected for 30 days.

Getting the Four Features to Actually Work

All four features are the right list. Sign-up, messaging, verification, and encryption are what the Security Rule reaches for.

Each one has a version that looks fine on paper and loses the patient. A code on a paper slip, a message nobody opens, a login nobody completes.

Start with enrollment, because the federal data points straight at it. Being encouraged by a provider moved portal use 30 points.

Then decide honestly which conversations need a portal at all. Results and records do. A reminder or a rescheduling question does not. Build the portal for the things that need one. Stop making patients log in for the rest.

See how secure messaging works when a patient taps a link instead of remembering a password. Book a Curogram demo.

Frequently Asked Questions