Portals also carry more protected health information than almost any other system a small practice runs. Diagnoses, medication lists, lab results, clinical notes, and billing history all sit behind one password. This article covers the specific gaps we see repeatedly, what regulators actually enforce, and what to fix first.
Quick Answer: Patient portals are authenticated web applications holding protected health information, so full HIPAA Security Rule safeguards apply: access control, unique user authentication, audit controls, and transmission security. The three failures we find most often are third-party tracking scripts running inside the authenticated portal, proxy and dependent access that was never revoked, and audit logs nobody reviews. Note that the 2024 court ruling on tracking technologies applies only to public webpages, not to portals. Portals remain squarely covered.
Why Portals Became the Softest Target in a Clinic
Patient portal adoption climbed sharply, and attackers followed. In 2024, 77% of individuals nationwide reported being offered online access to their medical records, up from 73% in 2022, and 65% accessed those records at least once in the past year (ASTP/ONC Data Brief No. 77, July 2025). Frequent users, meaning those logging in six or more times annually, reached 34%, more than double the 15% recorded in 2019.
That growth changed the risk profile. A portal now represents a permanently exposed, internet facing login page attached to your full clinical record set. Attackers do not need to breach your network if they can simply log in, which is why patient portal security HIPAA controls belong in your risk analysis as a named system rather than a footnote.
Fragmentation compounds the exposure. Nearly six in ten individuals, 59%, had multiple online medical records or portals in 2024, up from 50% in 2022 (ASTP/ONC, 2025). Patients reuse passwords across all of them, so a breach at an unrelated provider becomes a credential attack against your clinic.
Small practices feel this most acutely because portal administration usually falls to whoever has time. Our work with medical clinics and community health organizations shows the same pattern repeatedly: the portal went live years ago and nobody has audited it since.
Patient Portal Security HIPAA Requirements Clinics Misread
The HIPAA Security Rule does not carve out an exception for vendor hosted systems. Your portal must satisfy access control under 45 CFR 164.312(a)(1), person or entity authentication under 164.312(d), audit controls under 164.312(b), and transmission security under 164.312(e)(1). Your business associate agreement shifts some execution to the vendor, but it never transfers your compliance obligation.
Patient Portal Security HIPAA Duties You Cannot Delegate
Three misreadings come up constantly. Clinics assume that because the vendor is HIPAA compliant, the deployment is compliant. They assume encryption in transit satisfies the technical safeguards. They assume audit controls mean the system generates logs rather than that someone reviews them.
That third point matters most. Information system activity review under 164.308(a)(1)(ii)(D) requires you to actually examine records of system activity, including audit logs and access reports. Generating logs that nobody opens does not meet the standard.
Your patient portal security HIPAA posture also depends on a current risk analysis that names the portal specifically. If your last risk analysis predates your portal or treats it as a single line item, it will not survive scrutiny. Our HIPAA compliance work starts by mapping every system that touches protected health information, portals included.
The Tracking Script Problem Clinics Think Disappeared
This is the single most common misunderstanding we encounter, and it stems from real legal news that clinics have misapplied.
OCR issued guidance on December 1, 2022, and revised it on March 18, 2024, addressing tracking technologies such as cookies and pixels on websites, patient portals, and mobile apps. Hospital groups sued. On June 20, 2024, the US District Court for the Northern District of Texas ruled in American Hospital Association v. Becerra that HHS had exceeded its statutory authority, and it vacated part of the guidance. HHS withdrew its appeal on August 29, 2024, so that ruling stands.
Here is what clinics get wrong. The court vacated only the position that HIPAA obligations attach when a tracking tool connects an IP address with a visit to an unauthenticated public webpage about health conditions or providers. The court stated explicitly that its ruling was not intended to limit the rest of the guidance, and it left in place OCR’s position that connecting an IP address with activity on authenticated pages involves individually identifiable health information.
Your portal is an authenticated page. OCR’s guidance notes that tracking technologies inside patient portals may access substantial protected health information, including diagnoses, treatment and prescription details, and billing information. Marketing analytics, chat widgets, session recorders, and advertising pixels running behind the portal login are therefore a disclosure of protected health information to a third party, and they require either a business associate agreement or valid patient authorization.
For patient portal security HIPAA purposes, treat every authenticated page as a room containing charts. Ask your web team one question this week: what scripts load after a patient signs in? In our assessments, the answer surprises the practice more often than not.
Patient Portal Vulnerabilities We Find Most Often
The patient portal vulnerabilities below account for the large majority of findings in our clinic assessments. None require sophisticated attackers.
| Vulnerability | What we typically find | Provision at issue |
| Third-party scripts behind login | Analytics or ad pixels running on authenticated pages with no BAA | 164.502(e), 164.308(b) |
| Stale proxy or dependent access | Ex-spouses, adult children, or former guardians still linked | 164.312(a)(1) |
| Orphaned staff accounts | Departed employees retain portal admin rights | 164.308(a)(3)(ii)(C) |
| No audit log review | Logs exist, nobody has opened them | 164.308(a)(1)(ii)(D) |
| MFA off or optional | Password-only patient login | 164.312(d) |
| Weak identity proofing at enrollment | Registration relies on data an attacker can buy | 164.312(d) |
| Shared front desk credentials | One login used by several staff | 164.312(a)(2)(i) |
| No rate limiting on login | Unlimited password attempts permitted | 164.312(a)(1) |
| Untested for authorization flaws | Portal never penetration tested for record access across accounts | 164.308(a)(8) |
The last row deserves attention. Broken authorization, where changing an identifier in a request returns another patient’s record, remains one of the most damaging patient portal vulnerabilities and one of the least likely to be discovered without deliberate testing. Automated vulnerability scanners rarely catch it. Our penetration testing engagements test authorization boundaries directly by attempting cross-account access.
Patient Portal Vulnerabilities in Proxy and Dependent Access
Proxy access grew faster than any other portal feature and receives the least governance. Caregiver or proxy access more than doubled in four years, rising from 24% in 2020 to 51% in 2024 (ASTP/ONC Data Brief No. 77, July 2025).
Every proxy relationship is a standing authorization that should expire or change. A parent’s access to a minor’s record must adjust when confidentiality protections attach under state law. A spouse’s access should end at divorce. An adult child’s access to a parent’s record should end when the representative relationship does.
Most clinics have no process for any of that. Access gets granted at a front desk and never revisited, which produces unauthorized disclosures that surface only when a patient complains. Build a quarterly proxy review into your compliance calendar and document each decision.
Credential Attacks Are the Main Event
Portals fail through logins far more often than through exotic exploits. Stolen credentials appeared in 88% of Basic Web Application attacks, the pattern that portals fall under (Verizon, 2025 Data Breach Investigations Report). Credential abuse was the leading initial access vector across all breaches at 22%.
Password reuse makes this work. Analyzing infostealer malware logs, Verizon found that in the median case only 49% of a user’s passwords were distinct across different services (Verizon, 2025 DBIR). Your patients are using their breached retail password on your portal.
Automated attacks then run at scale. In single sign-on provider logs, credential stuffing accounted for 19% of all authentication attempts on a median daily basis (Verizon, 2025 DBIR research). Brute force activity against basic web applications nearly tripled year over year, climbing from roughly 20% to 60% of that pattern.
Multifactor authentication remains essential, but treat it as a control that needs maintenance rather than a finished project. The 2025 DBIR documented rising MFA bypass through push notification fatigue, session token theft, and adversary in the middle attacks. Strong patient portal security HIPAA practice therefore assumes credentials will leak and plans for detection. Phishing-resistant methods and session monitoring matter, and our security awareness training covers approval fatigue directly with staff.
What OCR Actually Enforces
Enforcement patterns tell you where to spend effort. OCR settled with BayCare Health System after determining that credentials belonging to a former employee of an affiliated practice were used to access a patient’s records. OCR found that BayCare had not adequately restricted access upon termination, lacked policies to prevent improper credential use, and had not taken sufficient measures to review system activity. A two year corrective action plan followed (HHS OCR, 2025).
Read that finding closely, because it maps exactly to the gaps above: termination procedures, credential governance, and audit log review. No ransomware, no sophisticated intrusion, just access that should have been revoked. Most patient portal security HIPAA findings look like this in practice.
Access rights carry enforcement risk too. OCR settled with Memorial Healthcare System for $60,000 after a patient repeatedly requested records by mail, by phone, and through the practice’s patient portal without receiving timely access (HHS OCR, 2025). Oregon Health and Science University settled for $200,000 in a similar right of access matter (HHS OCR, March 2025). A portal that generates requests nobody monitors creates liability rather than reducing it.
Documentation failures compound penalties. USR Holdings settled for $337,750 in a case where OCR cited missing risk analysis, no audit log review, and no retrievable backups (HHS OCR, January 2025).
Portal breaches also happen at scale. In December 2025, the ManageMyHealth portal in New Zealand was breached, with sensitive medical documents relating to more than 120,000 patients exfiltrated. The portal itself was the target, not the surrounding network.
Building a Secure Patient Portal
A secure patient portal comes down to seven controls that a small practice can realistically maintain.
Require multifactor authentication for patients and staff. Make it mandatory rather than optional, and prefer phishing-resistant methods where your vendor supports them.
Strengthen identity proofing at enrollment. Verify identity in person or through a channel an attacker cannot replicate with purchased data. Enrollment is where account takeover usually begins.
Review audit logs on a schedule. Assign a named owner, define what anomalies look like, and document each review. This satisfies 164.308(a)(1)(ii)(D) and catches misuse early.
Govern the full account lifecycle. Tie portal deprovisioning to your HR offboarding checklist so departures remove access the same day, and review proxy relationships quarterly.
Inventory every script on authenticated pages. Remove anything that lacks a business associate agreement and a documented purpose.
Test authorization boundaries. Have someone deliberately attempt to reach another patient’s record. Scanners will not find these flaws.
Monitor the login surface. Rate limiting, impossible-travel alerting, and credential-stuffing detection turn a silent compromise into an alert. Managed network and endpoint security provides that coverage when nobody internally watches logs overnight.
Clinics running virtual visits should apply the same standards to their video platform, since telemedicine tools authenticate patients and carry protected health information exactly as portals do.
Portal HIPAA Compliance and Vendor Oversight
Portal HIPAA compliance depends heavily on a vendor you do not control, which makes oversight a security function rather than a paperwork exercise. Third-party involvement in breaches doubled year over year and now accounts for 30% of all breaches (Verizon, 2025 DBIR).
Your business associate agreement should specify breach notification timelines, encryption standards, subcontractor disclosure, and your right to receive audit logs and security documentation. Ask for the vendor’s most recent SOC 2 report or independent assessment and actually read the exceptions section.
Then document what remains yours under patient portal security HIPAA obligations. Configuration, user provisioning, proxy decisions, log review, and staff training sit with your practice regardless of what the vendor does well. Write that division down so an investigator can see you understood it.
Worth noting: the proposed HIPAA Security Rule updates would make multifactor authentication, encryption, and asset inventories explicit requirements rather than addressable items. Those changes remain proposed, with final action now targeted for 2027, so the existing rule still governs. We track the status in our HIPAA Security Rule update analysis, and choosing a partner who follows this closely matters, which is why we wrote about selecting an MSP for a medical practice.
Note Worthy Info
- The 2024 tracking ruling does not cover your portal. The court vacated guidance about unauthenticated public webpages only, and left OCR’s authenticated-page position intact (AHA v. Becerra, June 20, 2024).
- Scripts behind the login are disclosures. Analytics or advertising pixels inside a portal need a business associate agreement or patient authorization.
- Patient portal security HIPAA duties stay with you. The vendor secures the platform; you own configuration, access, and review.
- Audit controls mean review, not generation. 164.308(a)(1)(ii)(D) requires someone to examine activity records.
- Credentials are the attack path. Stolen credentials featured in 88% of Basic Web Application attacks (Verizon, 2025 DBIR).
- Password reuse is near universal. Only 49% of a user’s passwords were distinct across services in the median case (Verizon, 2025 DBIR).
- Proxy access doubled and went ungoverned. Caregiver access rose from 24% to 51% between 2020 and 2024 (ASTP/ONC, 2025).
- OCR enforces revocation. The BayCare action turned on former-employee credentials and unreviewed system activity (HHS OCR, 2025).
- Right of access is portal-adjacent. Unmonitored portal record requests have produced settlements of $60,000 and $200,000 (HHS OCR, 2025).
Frequently Asked Questions
- Does patient portal security HIPAA responsibility sit with us or with our EHR vendor?
Both, in different places. The vendor is a business associate responsible for the platform’s security under your business associate agreement, while your practice remains the covered entity responsible for configuration, user provisioning, proxy access decisions, audit log review, and staff training. OCR investigates the covered entity regardless of who built the software.
- Can we run Google Analytics or a Meta pixel on our patient portal?
Not without a business associate agreement or valid patient authorization. OCR’s guidance holds that tracking technologies on authenticated pages such as patient portals may access protected health information including diagnoses, prescriptions, and billing details. The June 2024 court ruling narrowed the guidance only for unauthenticated public webpages.
- Is multifactor authenticationrequiredfor patient portals under HIPAA?
The current Security Rule requires person or entity authentication under 45 CFR 164.312(d) without naming a specific method, so MFA is not explicitly mandated today. The proposed Security Rule updates would require it, though final action is now targeted for 2027. Given that stolen credentials appeared in 88% of Basic Web Application attacks (Verizon, 2025 DBIR), we treat MFA as mandatory in practice.
- How often should we review portal audit logs?
Monthly review with documented findings works for most small practices, supported by automated alerting for anomalies such as impossible-travel logins or bulk record views. What matters to OCR is that review actually happens, has a named owner, and is documented, which is precisely what the BayCare settlement found lacking.
- What are the most common patient portal vulnerabilities in small clinics?
Third-party scripts running behind the login, proxy or dependent access that was never revoked, orphaned staff accounts after departures, audit logs nobody reviews, optional rather than mandatory MFA, and untested authorization boundaries that allow one patient’s session to reach another patient’s record.
- Do we needto penetrationtest our patient portal if the vendor already does?
Vendor testing covers the platform, not your specific configuration, integrations, or proxy setup. Ask for their testing summary, then test your own deployment, focusing on authorization boundaries and account enumeration. Broken authorization is the flaw scanners miss most often.
- How do we handle a teenager’s portal access when confidentiality rules apply?
Configure adolescent proxy access to match your state’s confidentiality law, which typically restricts parental visibility into certain categories of care once a minor reaches a specified age. Review these relationships as birthdays trigger changes rather than leaving access static, and document the policy so front desk staff apply it consistently.
The Bottsm Line
Portals earn patient trust and satisfy access requirements, and they concentrate more protected health information behind one password than any other system a clinic runs. Getting patient portal security HIPAA obligations right does not require a large budget. It requires knowing which scripts load after login, who still holds proxy access, whether anyone reads the audit logs, and whether your authorization boundaries have ever been tested.
Start with the script inventory and the proxy review this month. Both are free, both surface problems immediately, and both produce documentation that helps you during an audit. Then schedule authorization testing and turn MFA from optional to required.
If you want a second set of eyes on your portal configuration, request a free risk assessment and we will walk your practice through what we find.
About SecTec
SecTec is a managed security services provider based in McLean, Virginia, serving medical clinics, community health organizations, nonprofits, and faith based organizations across Virginia, Maryland, and the Washington DC region. Our team builds and operates client security programs, conducts HIPAA risk analysis and portal configuration reviews, performs authorization and penetration testing, and monitors endpoint and network defense across our client portfolio using NinjaOne and SentinelOne. Every article in our Medical Clinic IT series is written and reviewed by the practitioners who do this work daily.
Sources reviewed for this article: ASTP/ONC Health IT Data Brief No. 77, Individuals’ Access and Use of Patient Portals and Smartphone Health Apps, July 2025 (HINTS 7, 2024); Verizon, 2025 Data Breach Investigations Report and accompanying credential stuffing research; HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, December 2022 and revised March 2024; American Hospital Association v. Becerra, No. 4:23-cv-1110 (N.D. Tex. June 20, 2024); HHS OCR enforcement announcements 2025, including BayCare Health System, Memorial Healthcare System, Oregon Health and Science University, and USR Holdings; HHS OCR HIPAA Security Rule NPRM, January 2025; 45 CFR Part 164 Subparts C and E.
SecTec helps clinics close patient portal security HIPAA gaps through documented risk analysis, configuration review, and continuous monitoring.
