■ Medico-legal matters:

Understanding and responding to medico-legal challenges

Patient portals—Considerations for safety and medico-legal risk

4 minutes

Published: July 2021 /
Revised: October 2026

The information in this article was correct at the time of publishing.

In brief

Patient portals facilitate care and communication and enhance patient engagement, but also introduce risks for patients and physicians. These risks include privacy and security concerns, the potential for patients to misinterpret test results or clinical notes, and challenges when communicating serious diagnoses.
Physicians can reduce risks by enacting clear processes and robust safeguards, including strong privacy protections, patient education on portal use, and developing terms of use that set expectations.
Patient portals should complement, not replace, direct communication with patients. Physicians remain responsible for interpreting results, explaining medical information, and using judgment to determine when in-person, virtual, or telephone discussions are most appropriate. It’s especially important to not delay setting an appointment to discuss a serious diagnosis like cancer.

Using portals to engage patients

Patient portals can be implemented by physicians in their private offices and clinics, or established in hospital settings, or deployed province-wide (e.g. MyHealth in Alberta and Newfoundland and Labrador, and Dossier santé Québec (DSQ) in Québec). Regardless of their origin, patient portals enable patients to be more engaged in their care by having access to timely, relevant information on which they can take action to improve health and well-being.

Physicians can maximize the potential of patient portals in their private offices and clinics by:

Drawing attention to follow-up plans or desired actions: Draw attention to information you feel is important for patients to know, such as the plan of care and actions for patients to take. For example, you may want to include reminders about scheduled tests and appointments. Encourage patients to contact you if they have questions or concerns.
Highlighting patient accomplishments: Patient portals can be used to highlight patient accomplishments and encourage patients to make positive changes that will improve their health. While you may already be discussing positive change when speaking to patients in-person, you might consider doing the same via a patient portal.
Providing additional information: As a communication tool, patient portals can provide people with helpful resources and additional information concerning their health and plan of care. Consider adding links to reliable online resources that can inform and educate, provide context, and inspire action.

Reducing medico-legal risk

While physicians can generally exercise only limited control over the use of hospital or provincially-based patient portals, physicians using portals in their private offices or clinics can take measures to reduce the risks:

Use robust security and privacy protections: Physicians have professional and legal obligations to ensure patients’ personal health information is kept private and secure. Patient portals should have security features that adequately protect patient information from unauthorized access. For example, the Collège des médecins du Québec encourages the use of patient portal technology that is certified by the provincial government. Encryption, as well as rules about who can access data, can help minimize these risks.
Provide guidance and be transparent: When introducing a patient portal, some patients may benefit from guidance on how and where to use it. For example, you may want to alert them to the types of locations where they should ideally access the portal to help maintain information privacy and security (i.e. an area that allows for private viewing). Also, inform them of whether other treating professionals will have access and if so, to what information.
Manage expectations: When introducing a portal, inform patients of expected response times and when new information will be posted to the portal—which likely will not be immediately. Remind patients that the portal is not intended to be used for medical emergencies. Encourage patients to access lab results via commercial lab portal, when applicable. Include terms of use on the patient portal, which clarify expectations and outline the terms and conditions under which patients may access the portal and how it will be used. The CMPA’s template agreement, Terms of use agreement template for physician websites [PDF], is helpful for this purpose.

Ensuring appropriate documentation

Any clinical notes made available on patient portals should always reflect professional language and be written in a way that is easy for patients to understand. For example, avoid abbreviations and jargon—medical or otherwise.

Some Colleges also require or recommend that any communications with patients related to clinical care that occurs through a portal be captured in the patient’s medical record.

For tips on writing medical record entries, see the article “Writing with care: Word choice matters in medical records and reports”.

In-person or virtual communication?

Patient portals should generally not be used as the sole method of communicating with patients; there are times when in-person or telephone communication is appropriate and necessary. There is always the potential that important information posted on a portal is not read.

Treat a patient portal as an enhancement to in-person and telephone communication, not as a complete substitute for these traditional methods.
If you provide clinical advice through the portal, it should be consistent with established clinical standards, including those outlined in College policies on providing virtual care.
Whether or not you use a patient portal in your practice, you remain responsible for explaining medical information, interpreting and communicating test and lab results in a timely fashion, and exercising clinical judgment regarding diagnoses and treatments.

Changes to information

Once a patient accesses their medical record via a portal, it is possible they may request that changes be made to its contents. In such instances, keep in mind that the guidance for managing information in medical records extends to patient portals. For more information, see the CMPA article “The medical record: A legal document — Can it be corrected?”

CMPA EasySearch