Patient portal development means building a secure web and mobile app where patients can book appointments, see their results and records, pay bills, message the care team and manage family members' care. Done well, it takes routine calls off the front desk and gives patients answers at any hour. Done badly, it becomes a login nobody remembers.
The build itself is rarely the hard part. The hard parts are integration with the hospital's systems, getting the rules right for results release and privacy in each market, and making patients actually use it. In the US, the 21st Century Cures Act expects patients to get prompt electronic access to their information. In India, ABDM lets patients pull records into a personal health record app using their ABHA. In the UAE and UK, identity, data residency and national app ecosystems shape the design.
This guide covers the features, compliance, integrations, adoption tactics and indicative costs of patient portal development.
What is a patient portal?
A patient portal is a secure, patient-facing application connected to a hospital's or clinic's systems, which lets patients view their health information and complete routine tasks themselves. It typically draws data from the HIS or EHR, laboratory and imaging systems, and billing, and sends actions such as bookings and messages back to them.
Portals come in three forms: the portal bundled with your EHR (for example, Epic's MyChart), a white-label portal product configured with your branding, or a custom portal built around your workflows.
Patient portal features: what to build first
| Feature | Why patients use it | Phase |
|---|---|---|
| Secure login, OTP and family (proxy) access | Parents and adult children manage care for others | MVP |
| Appointment booking, rescheduling, cancellation | The most common reason to log in | MVP |
| Lab and imaging results with reports as PDF | The second most common reason | MVP |
| Bills, receipts and online payment | Fewer billing calls and queues | MVP |
| Prescriptions and visit summaries | Patients lose paper copies | MVP |
| Reminders via WhatsApp, SMS and push | Most patients will not check a portal unprompted | MVP |
| Pre-visit forms and registration | Shorter waits at the desk | Phase 2 |
| Secure messaging with care team | Useful, but needs staffing rules | Phase 2 |
| Teleconsultation | Follow-ups and remote patients | Phase 2 |
| Health record import (ABHA, FHIR) | Records from other providers | Phase 2 |
| Insurance and pre-authorisation status | Fewer calls to the TPA desk | Phase 2 |
| Plain-language result explanations | Helps patients understand results | Phase 3, with review |
For the booking side specifically, see our guide to online appointment booking for clinics.
How a patient portal works behind the screen
- The patient logs in with a phone OTP, email or national identity, and the portal matches them to one or more patient records.
- The portal reads appointments, results, documents and bills from the HIS or EHR through APIs, HL7 v2 messages or FHIR resources.
- Actions such as bookings, form submissions and payments are written back through the same interfaces, with validation.
- Events such as a result becoming available or a bill being raised trigger notifications through WhatsApp, SMS, email or push.
- Every access and action is logged for audit, and sensitive results follow release rules set by the hospital.
Most of the effort in patient portal development sits in steps 2 and 3. Our healthcare integration work usually begins with an inventory of what the HIS can expose and what needs a middleware layer.
Build, white-label or extend your EHR portal?
| Option | Best for | Trade-offs |
|---|---|---|
| EHR's own portal (e.g. MyChart) | Hospitals on a major EHR that already licenses it | Fast and integrated, but limited customisation and branding |
| White-label portal product | Clinics wanting a quick launch | Monthly fees, integration limits, data location set by vendor |
| Custom patient portal | Groups with their own HIS, several systems, or local channel needs | Higher upfront cost, full control of features, data and roadmap |
Custom development makes most sense when your HIS has no strong portal, when you need WhatsApp-first journeys and local languages, when data must stay in a specific country, or when you run several hospitals on different systems.
Compliance by market
United States. A portal that handles PHI needs HIPAA safeguards and BAAs with every vendor in the chain. The 21st Century Cures Act information blocking rules mean most results should be made available to patients without unnecessary delay, with limited exceptions such as preventing harm. An ONC-backed study of 2024 national survey data found patients prefer immediate access to test results, even before discussing them with a clinician, while also wanting more help understanding them. Design for both: fast release and clear explanation.
United Kingdom. NHS organisations expect DTAC assessment, DSPT compliance, a DPIA and clinical safety documentation. Many patients already use the NHS App, so a portal for an NHS provider should complement it rather than duplicate it; private providers have more freedom but still fall under UK GDPR.
UAE. The federal health data law generally requires health data to be stored and processed in the UAE, so host the portal and its database in a UAE cloud region. Arabic and English, right-to-left layouts and national digital identity login (UAE Pass) are common expectations. Records may also need to flow to NABIDH, Malaffi or Riayati through your clinical systems.
India. ABDM lets patients link records to their ABHA and share them through consent. The scale is large: the National Health Authority reported more than 100 crore health records linked to ABHA in 2026. A portal can act as the hospital's window onto these flows, and the DPDP Act and Rules require clear consent and security safeguards. See ABDM integration for hospital software.
Why patient portals go unused, and how to fix it
Many hospitals launch a portal and see low activation. The causes are predictable.
- Nobody is told about it. Activation should happen at registration, with the desk sending a link by WhatsApp or SMS.
- The first login is painful. Use phone OTP, not usernames and passwords patients forget.
- There is nothing new to see. Results, bills and summaries must appear automatically and promptly.
- Patients live in WhatsApp. In India and the Gulf, send the result notification and a deep link on WhatsApp rather than expecting an app visit. Our WhatsApp automation guide covers templates and opt-ins.
- Family members are locked out. Without proxy access, the person managing an elderly parent's care cannot help.
Accessibility, language and older patients
The patients who need a portal most, older adults and people managing chronic illness, are often the ones it serves worst. Design for them from the start.
- Follow WCAG 2.2 AA guidelines: readable text sizes, strong contrast, labelled buttons and full screen reader support.
- Offer the languages your patients actually speak: Arabic and English in the UAE; Hindi, Malayalam, Tamil and other regional languages in India; Spanish and others in many US markets.
- Keep the main tasks to two or three taps from the home screen: book, see results, pay.
- Show results with reference ranges and a plain-language note, and make clear when a clinician will call about abnormal values.
- Let a family member or carer help without sharing passwords, using proper proxy access.
- Test with real patients over 60 before launch; their feedback will change the design more than any internal review.
Security essentials
- Encrypt data in transit and at rest, and keep secrets out of the app bundle.
- Use short-lived sessions, device binding for mobile apps and rate limits on OTP endpoints.
- Authorise every API call by patient and proxy relationship, not just by login.
- Log access to every record and alert on unusual patterns.
- Run penetration tests before launch and after major changes.
- Plan for account recovery when patients change phone numbers.
Indicative cost of patient portal development
| Scope | Indicative range (USD) | Approx. INR | Approx. AED |
|---|---|---|---|
| Web portal MVP: login, booking, results, bills, payments, one HIS | 25,000-60,000 | 22-53 lakh | 90,000-220,000 |
| Web plus iOS and Android apps, proxy access, notifications | 60,000-120,000 | 53 lakh-1.05 crore | 220,000-440,000 |
| Multi-hospital portal with telehealth, ABHA or FHIR import, multiple systems | 120,000-250,000+ | 1.05-2.2 crore+ | 440,000-920,000+ |
What drives cost: the number and quality of systems to integrate, native apps versus web, languages, proxy and consent rules, teleconsultation, and compliance documentation. Running costs include hosting, SMS and WhatsApp fees, app store accounts, security testing and support, typically 15-20% of the build per year. Teams based in India usually deliver the same scope for less than US or UAE agencies, which is why many US and Gulf providers use them with overlapping working hours.
How Algon approaches this
Algon, a Kochi-based team delivering for hospitals and clinics in India, the UAE and the USA, builds patient portals as part of patient engagement work rather than as a standalone app. We start from the hospital's own events, such as a booking, a result or a discharge, connect them to the portal and WhatsApp, and give each patient-facing journey a named owner on the hospital's staff. Our patient onboarding building blocks for registration, consent and family records come from earlier deployments, so the portal does not start from zero.
Conclusion
Patient portal development succeeds when the portal is fed automatically by your systems, opens with a phone number, reaches patients where they already are and lets families help. Get the integration and release rules right for your market, launch a focused MVP, then add messaging, telehealth and record import once patients are using the basics. If you are planning remote consultations as part of the portal, see our guide to telemedicine software development.
Frequently asked questions
What is patient portal development?
It is the design and build of a secure web or mobile app that lets patients book appointments, view results and records, pay bills and message their care team. Most of the work is integrating it with the hospital's HIS or EHR, lab and billing systems.
How does a patient portal work?
The patient logs in, the portal matches them to their records, reads appointments, results and bills from hospital systems through APIs, HL7 or FHIR, and writes actions such as bookings back. Notifications tell patients when something new is available.
How much does it cost to build a patient portal?
Indicatively, a web portal MVP integrated with one HIS costs USD 25,000-60,000, web plus mobile apps USD 60,000-120,000, and a multi-hospital portal with telehealth and record import USD 120,000-250,000 or more, plus 15-20% a year to run.
What features should a patient portal have?
Start with OTP login and family access, booking, results, bills and payments, prescriptions and visit summaries, and notifications. Add pre-visit forms, secure messaging, teleconsultation, insurance status and record import once patients use the basics.
Is a white-label patient portal better than custom development?
A white-label portal is faster and cheaper to launch for a single clinic with a supported system. Custom development is better when you run several systems or hospitals, need WhatsApp-first journeys and local languages, or must control where data is hosted.
Do patient portals have to release test results immediately?
In the US, Cures Act information blocking rules generally require prompt electronic access to results, with limited exceptions such as preventing harm or honouring a patient's request to delay. Other markets set rules through local policy, so define release rules per result type.
