Choosing a Patient Portal Partner: A HIPAA Checklist for Clinics

What should a clinic ask before hiring a patient portal developer?

Most clinics start shopping for a portal because something hurts: intake still runs on clipboards and fax, the front desk re-keys the same answers into two systems, or patients call after hours with questions the website could answer. The right partner starts with that problem, not with a feature list.

Before you compare proposals, ask each vendor to walk through one real workflow from your practice, such as a new-patient intake or a referral, and show where protected health information enters, where it is stored, who can see it and where it leaves. A vendor who cannot draw that map clearly is not ready to build it.

Which HIPAA safeguards should be built into the portal itself?

HIPAA's Security Rule describes administrative, physical and technical safeguards. A developer cannot hand you a compliant practice, but it can build the technical safeguards into the system so they work every day without anyone remembering to turn them on. In the healthcare systems Netsam builds, these are part of the design, not an add-on:

• Role-based access with least privilege, so a scheduler sees schedules and a billing clerk sees billing, with separate credentials for development, staging and production.
• Audit logs that record who accessed or changed protected health information, and when.
• Encryption in transit and at rest, for the portal, the database and backups.
• Automated backups with restores tested on a schedule, not just assumed to work.
• PHI kept out of AI and automation steps unless the vendor agreement covers that use.
• A named person who approves anything that leaves the system.

Will the vendor sign a business associate agreement, and what does it cover?

If a vendor will create, receive, store or transmit protected health information on your behalf, you need a business associate agreement (BAA) with them. Ask early, because a vendor who hesitates here will hesitate elsewhere.

Read the BAA alongside the proposal. It should match what the vendor actually does: if they host the portal, the agreement should reflect hosting; if they use subcontractors such as a cloud provider or a messaging service, ask how those relationships are covered. Also ask what happens to your data if the relationship ends, and in what format you get it back.

Who will host, patch and monitor the portal after launch?

A portal is not finished at launch. Software needs security patches, certificates expire, storage fills and someone needs to notice when a form stops submitting at 7 p.m. on a Friday. Ask every vendor who does that work and how you will know it was done.

Netsam builds, hosts and runs what it builds, so there is one firm accountable when something is slow or broken. Our hosting and managed infrastructure includes monitored environments, scheduled patching, access control and restores tested on a fixed schedule, with a monthly operations report. If you prefer to host elsewhere, ask how the vendor will oversee that environment instead.

How do you judge a vendor's approach to AI in healthcare?

Many portal proposals now include an AI assistant. Done carefully, a front-desk assistant can answer routine questions about hours, locations and forms, and route appointment requests around the clock. It should never give clinical advice.

Ask how the vendor keeps a person in charge. Netsam's rule is simple: AI drafts, humans apply judgment, and systems scale with confidence. Exceptions go to staff for review, every action is logged, and nothing irreversible happens without a recorded approval. You can read more about that model on our How We Work page.

How does Netsam help clinics get started?

We begin with discovery: sitting with your front desk, mapping where patient information lives, and naming the compliance requirements on day one. Then we build a running prototype of your intake or scheduling flow on real forms, so your staff can react to something concrete before the full build begins.

If your practice is weighing a new portal or rebuilding a patient website, we would be glad to walk through your workflow with you. Discuss your project with our team or call 866-294-3489.

Frequently asked questions