Case studies / Healthcare
Case studyA secure patient portal for a clinic network
A network of clinics built a secure patient portal for online booking, records access, messaging and reminders, designed around privacy from the start to speed approvals.
Overview
A private network of outpatient clinics offering general practice, physiotherapy, dermatology and diagnostic services across several cities. Patients pay directly or through insurers, and expect the convenience they find elsewhere online.
Scale. Many thousands of registered patients, eight clinic locations and more than one clinical and administrative system behind the scenes.
The challenge
Booking an appointment meant phoning a clinic during opening hours and waiting in a queue. For working patients, that often meant a call from a car park at lunchtime, and for reception teams it meant a ringing phone that never stopped.
Patients could not see their own records. Test results, letters and treatment plans were sent by post or explained over the phone, and patients who wanted a copy had to ask in writing.
Clinics lacked a consistent digital experience. Some had their own booking pages, others used email, and the experience changed depending on which clinic and which service a patient used.
Missed appointments were costly. Reminders were sent inconsistently, and an empty slot in a specialist clinic is lost income that cannot be recovered.
Any digital service handling health records had to satisfy the clinical governance board, the data protection officer and insurers. Previous digital proposals had stalled for months in that review.
Behind the scenes, patient information sat in a practice management system and several specialist systems, each with its own identifiers and access rules.
The solution
Patients book, change and cancel appointments online, choosing from real availability drawn from the practice management system. Booking rules control which services can be booked directly and which need a referral or triage first.
Patients can see upcoming appointments, test results and letters once a clinician has released them, with plain-language explanations where appropriate. Sensitive results can be held until the clinician has spoken to the patient.
Secure messaging lets patients contact their clinic about non-urgent matters. Messages are routed to the right team, response times are tracked and every message is stored in the patient record.
Automated reminders go out by text and email before each appointment, with a simple option to confirm or cancel so that freed slots can be offered to other patients.
Identity is managed through a dedicated identity service with multi-factor authentication. All access is logged, and patients can see who has viewed their information through the portal.
Administration tools let clinic teams manage availability, booking rules, message routing and content, and analytics show usage, booking patterns and missed appointment rates by clinic.
The engagement
- Nine months
- Six specialists, including a security architect
- User journeys and security requirements, design and build of a patient portal with online booking, records access, secure messaging, reminders and administration tools, five integrations, a two-clinic pilot and network rollout.
Integrations
- Practice management system
- Identity service
- Payments
- Messaging
- Analytics
How we delivered it
- 01
Journeys and security first
Seven weeks
We defined user journeys with patients, clinicians and reception teams, and in parallel set out security and privacy requirements with the data protection officer and clinical governance board. Threat modelling and a data protection impact assessment were completed before design began.
- 02
Design and build
Five months
We designed and built the portal with strong identity controls, encryption and detailed audit logging. Clinicians reviewed how each type of record would be presented before it was released to patients.
- 03
Pilot two clinics
Six weeks
Two clinics with different services piloted the portal with their patients. We refined booking rules, messaging workflows and the way results were explained based on patient and staff feedback.
- 04
Network rollout
Six weeks
The portal rolled out across the network clinic by clinic, with reception teams trained to help patients register and use it.
Results
- Fewer phone bookings, more out-of-hours booking
- Self-service access to results and letters
- Fewer missed appointments
- Governance approval without late redesign
Phone bookings have fallen. A growing share of appointments is now booked online, much of it outside opening hours, and reception teams have more time for the patients in front of them.
Patients access information themselves. Results and letters arrive in the portal when clinicians release them, and requests for copies of records have dropped sharply.
Missed appointments have reduced. Reminders with a simple cancel option mean that slots are released and rebooked rather than left empty.
Approvals were faster than any previous digital project. Because security and privacy were designed first, the governance board and data protection officer reviewed a finished assessment rather than raising concerns late in the build.
For once, the governance board was reviewing a design they had helped shape, not a system they were being asked to accept.
What made the difference
Security and privacy were designed first, which sped approvals.
