A HIPAA-compliant patient portal that unified 12 clinics behind one login, and cut no-shows by 35% with smart, FHIR-driven reminders. 75,000+ patients, one secure front door.
Each of the 12 clinics ran a different EHR, so the hard part was never the UI, it was the contract. We standardized every integration on FHIR R4, treating each clinic as a federated source behind a single gateway.
PostgreSQL row-level security made tenancy a database guarantee rather than an application convention: a patient query physically cannot cross a clinic boundary, even if app code is wrong.
No-shows were the network's most expensive recurring loss. Instead of reminding everyone, a scheduled worker scores each upcoming appointment by historical no-show risk and only escalates the visits that need it.
Those reminders go out over Twilio with delivery receipts, and confirmations flow straight back into the FHIR appointment resource, closing the loop without staff intervention.
| Component | Technology | Why |
|---|---|---|
| Frontend | Next.js (RSC) | Server-rendered PHI never ships logic to the browser; sub-second loads. |
| Data store | PostgreSQL + RLS | Per-clinic isolation enforced at the row level, not in app code. |
| EHR integration | FHIR R4 | One standard contract across 12 different EHR vendors. |
| Notifications | Twilio SMS | Reliable delivery and per-message status for reminder receipts. |
| Infrastructure | AWS (VPC, KMS) | Encrypted, network-isolated, HIPAA-eligible services. |
| Reminders |
One OAuth2 identity with MFA spans all 12 sites without re-registration.
Appointments and encounters stay consistent between the portal and each EHR in near real time.
Twilio messages target high-risk visits, with confirmations written back automatically.
Sensitive identifiers are encrypted per-field via AWS KMS on top of at-rest encryption.
Every PHI access emits a tamper-evident event for HIPAA reporting and forensics.
Patients view and settle balances in-portal, reconciled back to each clinic's billing system.
“Tenancy isn't a feature you remember to check, it's a row the database refuses to return.”
The portal turned 12 disconnected clinics into one coherent patient experience without forcing a single EHR migration. 75,000+ patients now manage records, reminders, and bills from a single HIPAA-compliant front door, and the risk-scored reminder engine cut no-shows by 35%, recovering revenue that more than paid for the build. FHIR-first integration and database-enforced isolation mean adding clinic number 13 is a configuration change, not a rewrite.
| Risk-scored worker |
| Targets high-no-show visits instead of blasting everyone. |