Sections included:


For patient confidentiality and compliance with privacy laws, you must take precautions to ensure that no one (including parents, adult children, spouses, etc.) gains unauthorized access to a patient's data on the Patient Portal. For various reasons, an email address on file for a patient may not be one that he or she has any access to. It could be a shared account or belong to a spouse or adult child of the patient.

For this reason, Patient Portal access should only be granted after confirming that:

  1. The Patient Portal account and password were set up by the patient or an authorized third party, and
  2. >Only the patient and any authorized third parties have access to the primary email account connected to the account.

Strong operational security should be provided on an ongoing basis, particularly when a change of email address is requested.

View A Patient's Portal Status

Instantly view a patient's portal status by looking at the secure message icon shown in the patient's photo block in the top left-hand corner of the patient chart:

  • Inactive Portal Icon Patient cannot access the Patient Portal because one or more of the following is true for him/her: (1) Patient Portal access if not enabled, (2) no email address on file, or (3) no ZIP code on file.

  • Unactivated Portal Icon Patient can access the Patient Portal but has never done so.

  • Secure Message Icon Patient is set up on the Patient Portal and has accessed his or her portal account.

Enable Patient Portal Access

Patient Info

To enable or disable Patient Portal access for a patient, open the Patient Information pop up by clicking on the pencil icon just below the patient's profile picture, and click on the Patient Portal tab (generally at the far right). Toggle the button for Patient's Access Level to "Patient Can Access Portal" to enable access, or to "No Access to Portal" to disable.

For patients who you add manually (versus those who are added when they sign up via an electronic registration form), Patient Portal access is automatically enabled if "Should the patient be able to activate portal without further confirmation" is checked.

A patient who signs up with your practice via our electronic registration form will automatically have Patient Portal access enabled when the patient verifies his or her email address by clicking on the link in the automatically-generated confirmation email. If that verification step is not completed, Patient Portal access will remain toggled off and you will need to manually enable the patient's Portal account as described above, then have the patient follow the process for resetting his or her password.

Patient Portal Access Popup

To enable Patient Portal access, you will need to have a home zip code and email address on file for the patient. For patients who want to share a single email address, each one must have a unique username for the Patient Portal.

For detailed information about troubleshooting Patient Portal access (written for patients), see Logging in to your Patient Portal Account and Creating your Patient Portal Account.

Important Privacy Note

Before granting access to the patient portal, it is important that you verify with the patient that only he or she and authorized third parties have access to the listed email account. Any other people that have access to the account could potentially gain unauthorized access to protected health information, in violation of privacy laws.

Once patient portal access is enabled, be very cautious when changing a patient's email address to make sure that the change request is authorized and not an attempt by a third party to gain unauthorized access.

Invite Patients to Use the Portal

Patients are able to set up their own portal accounts (or reset their passwords) from the patient portal as long as the following information is set up in the EMR:

  • ">Patient is Active (i.e., hasn't been marked as inactive);
  • ">Has their patient portal status set to enabled (as shown above);
  • ">Has a valid email address on file; and
  • >Has a Last Name, Date of Birth, and ZIP code on file.

However, there are many times when it's more convenient to set up patients' portal accounts from the EMR. MD HQ offers three methods of allowing MD HQ users to get patient's onto the portal:

  1. You or your staff can ">manually set the username and password for the patient (this can be especially helpful in cases where the patient does not have an email address or is very uncomfortable with technology). To do this, just open the patient's basic information editor (the little pencil icon on the Patient Information block). From the patient portal tab just make sure that portal access is enabled, and then set a username and password (the username field will turn green if it's valid and unique):

    Then just hit the "Edit Patient" button and tell the patient what their new credentials are.

  2. You can also have the EMR send out an invitation to the patient, which includes a custom link that will allow them to set up their username and password. This is a great way of getting patients onto the portal if you're just getting started with MD HQ and you'd like to bring over your existing patients. From the top menu select My Links > Patient Portal Onboarding Tool. This will open up a custom report that lists all your patients, and next to each patient is (a) a colored icon that shows whether the patient is forbidden from accessing the portal (which you can click to enable portal access) or has already been invited to the portal; and (b) shows a link for inviting the patient to the portal. If the link isn't showing next to a patient just make sure that you've enabled portal access (by clicking on the red square) and that the patient has a valid email address on file.

    Simply click the invite link and it will set the patient an invitation with instructions for setting up their account. This email will contain an encrypted link which - when followed - will let the patient set their password and it will also prompt them to create a username if one has not already been set. As soon as the invite has been sent the square next to the patient's name should change to orange to indicate that an invite has been sent. As soon as the invite has been accepted, this square will change to green.

  3. Use the Patient Portal Onboarding Tool (if activated on your build) to invite several patients at a time.


If needed, reset a patient's Patient Portal password by opening the Patient Information pop up by clicking on the pencil icon just below the patient's profile picture, then clicking on the Patient Portal tab (generally at the far right). Check the box labelled "Patient's Password" and enter the new password. Click +Edit Patient to finalize the new password, and send the password to the patient via a secure route.

Troubleshooting Patient Portal access based on secure message icon color:

  • Inactive Portal Icon Click on the edit icon Edit icon in the Patient Information block and then on the Patient Portal tab in the pop-up window that appears. Make sure that "Patient Can Access Portal" is selected. Click on the basic data tab to make sure that the patient has both an email address and a ZIP code on file.
  • Unactivated Portal Icon Direct the patient to click on "I am a registered patient. Create my Patient Portal account" on your Patient Portal login page. The patient will need to enter his or her email, last name, date of birth, and ZIP code, all of which must match the corresponding information on file with you.
  • Secure Message Icon Direct the patient to click on "I forgot my password" on your Patient Portal login page to reset his or her password. The patient will need to enter his or her email, last name, date of birth, and ZIP code, all of which must match the corresponding information on file with you.

If the patient is having trouble setting or resetting his or her password (i.e., is getting an email that his or her account could not be verified), there is likely a mismatch between the verification information being entered (email, last name, DOB, ZIP) and the corresponding information on file with you. Double check your information with the patient