They have a bunch of very specific rules for who should be able to schedule in the portal, and these are defined in different places. The flow is as follows:
1. In patient_portal/html/custom/components/pt_menu.php:
The "Appointments" tab of the portal will be disabled (grayed out and throws an alert if they try clicking on it) until either (A) the patient has a SOAP note in their chart or (b) the patient has at least one scheduled event in the calendar. This rule gets overridden IF they have primary provider Ramzi, Schweig, or Dr Cook (in which case, they should be able to click on the "appointments" tab even without soap notes or appointments)
2. In patient_portal/html/custom/ajax/check_pt_forms_b4_schedule.php:
Once a patient can access the "Appointments" page of the portal, there is another round of checks to make sure the patient (A) has a CC on file, (B) the patient has completed the Arbitration Agreement, and (C) if added before 3/6/17, the patient has completed the PHI Disclosure for Trainings. If any of these isn't true, the page will throw a pop-up asking the patient to do whatever is missing.