Managing Patient Portal Credentials

Last updated: 16 April 2026

Managing Patient Portal Credentials

Patient portal credentials control how patients log in to the portal. They are separate from the contact details on the patient record and must be unique per organisation.

Portal Credentials vs Contact Details

The patient record has two sets of contact information:

  • Contact details (email, phone, mobile, home phone) - used for general communication, SMS reminders, and appointment notifications. These can be shared between patients (e.g. a parent's email on a child's record).
  • Portal credentials (auth email, auth mobile) - used exclusively for portal login. These must be unique per organisation. Two patients cannot share the same portal credential.

This separation exists because families often share contact details, but each patient needs their own login.

Viewing Credentials

There are two places to view a patient's portal credentials:

  1. Patient record > Online Access tab - shows the individual patient's configured email and mobile credentials with verification status
  2. Settings > Patient Authentication > Credentials tab - shows all patients with configured credentials in a searchable table

Setting Up Credentials

To configure portal credentials for a patient:

  1. Open the patient's record
  2. Go to the Online Access tab
  3. Click Configure Credentials
  4. Enter the patient's email and/or mobile number
  5. Confirm that you have verified the credential with the patient
  6. Click Save

Credentials set by an admin are marked as unverified until the patient completes their first login with a one-time code.

Clearing Credentials

To remove a patient's portal access:

  1. Open the patient's record > Online Access tab (or use the credential sidebar in Settings)
  2. Click Remove Email or Remove Mobile
  3. The credential is cleared and the patient can no longer log in via that method

If both credentials are removed, the patient loses all portal access.

Verification Status

Each credential shows one of two states:

  • Verified - the patient has successfully logged in using this credential (shows verification date)
  • Unverified - the credential has been set but the patient has not yet verified it via OTP

Bulk Backfill from Demographics

If you have many patients without portal credentials, use the backfill feature:

  1. Go to Settings > Patient Authentication
  2. Open the Credentials tab
  3. Click Backfill credentials
  4. The system scans all patients and promotes unique contact details to portal credentials:
    • A patient's mobile phone becomes their auth mobile (if unique in the organisation)
    • A patient's email becomes their auth email (if unique in the organisation)
    • Shared contact details are skipped automatically
  5. All backfilled credentials are marked as unverified

Tip: Run the backfill after importing patient data from another system. It saves setting up credentials one by one. Shared contact details (e.g. a parent's email used for multiple children) are automatically excluded.