User Guide — athenahealth Account for Patient Portal Users (2024)

The best way to register patients for the Patient Portal is to register them in your office or to send them an email invitation. These methods are preferred because athenaOne knows who the patient is, who the provider is, and what department the patient is registered in; there's no need to ask the patient to enter any demographic information.

For example, when the patient receives an email invitation, opens it, and clicks Register Now:

• The first factor of authentication is the email itself.
• The second factor is the call or text message that the patient receives to confirm her identity.

Your practice has the patient's email address and phone number, and the patient's identity is confirmed when she responds to a message that the Patient Portal sends to the corresponding device.

When patients register for the Patient Portal on their own

When one of your patients searches the Internet for your practice, finds your website, and decides to register for the Patient Portal on their own (without an email invitation from your practice), no electronic link exists between the patient and your practice. The Patient Portal collects some initial information:

• Is this a patient or a patient's family member?
• Basic demographic information about the patient: first name, last name, gender, DOB, phone number, and email address.

The Patient Portal attempts to match this demographic information to existing patients at your practice by checking the first name, last name, gender, DOB, and either the phone number or email address. Even if this information matches one of your patients in athenaOne, the information constitutes only one factor of authentication, so the Patient Portal cannot tell the user whether it has confirmed that she is a patient at your practice.

Someone could fraudulently enter another person's first name, last name, gender, DOB, and phone number on the Patient Portal in an attempt to "phish" for PHI. The Patient Portal cannot reveal anything, including whether the named person is a patient at the practice, until there is a second factor of authentication, such as confirming the person's identity via phone or text message.

For this reason, the Patient Portal then asks the user to confirm his identity via phone or text message. After the user confirms his identity, the Patient Portal can safely indicate the user's next steps:

• If the user is an existing patient at your practice and enters the correct demographic information, the Patient Portal matches the user to a patient at your practice. This user sets a password and completes the Patient Portal registration without any issues.
• If the user is an existing patient at your practice but enters demographic information that does not match a patient record for your practice in athenaOne, a warning message instructs the user to call your office to resolve the problem. This user should not continue the Patient Portal registration process.
• If the user is a brand new patient, the demographic information she enters will not match any patient record for your practice in athenaOne. The Patient Portal prompts the user to select a provider and location, and then create a password. After the user does this, she is registered as a new patient at your practice, with the correct provider, department, and provider group; the user is also registered for the Patient Portal.
  Note: New patients who register for your practice on the Patient Portal appear on the Manage Prospective Patients page.