Patient portal

The patient portal is a private page for each patient on Smileline's patient website. Patients open it in one of two ways: with a secure link you send them plus their date of birth, or with their own account (an email and a password, with two-factor sign-in if they want it). Parents and guardians you record on a child's Details › Family can open that child's portal, for as long as the relationship allows it.

Switch the portal on

1. Go to Settings › Website & booking › Patient portal.
2. Turn on Patient portal.

Anyone who can change settings switches it. The page then shows the Portal address, the page every link and invitation opens. An owner can click Change address, then Change the address now: every portal link and app connection sent so far stops working, and people already signed in stay signed in.

Turning the portal off stops every link and account from opening a record at once; turning it on again brings them back.

While the portal is on, the same page has three more switches, each off until you turn it on:

• Shared documents: patients see the documents you share from their record (see Share documents).
• Online plan signing: patients accept a presented treatment plan online (see Sign plans online). Practices in the UK, the US and Italy only.
• Balance payments: whoever pays an account sees its balance and statements and pays by card (see Balance payments).

Send a secure link

1. Open the patient's record and go to Details.
2. In Patient portal, click Send portal link.
3. Under Who for, choose the patient themselves, or one of their parents or guardians with portal access (see Parents and guardians).
4. Under How, choose Text, Email or Show QR.
5. Click Send.

The person opens the link and enters the patient's date of birth — for a child's portal, the child's. Then the portal opens.

• A link works for 30 days. Sending it again to the same mobile or email renews it.
• Sending it to a different mobile or email, or once it is 90 days old, makes a new link. The old one then says a newer link was sent.
• Five wrong dates of birth lock the link. It shows Locked in Patient portal. Check who is asking before you send a new one: the next Send portal link asks you to tick that you did.
• Cancel link (two clicks) stops it at once.
• The page hides itself after three minutes untouched or in the background, and asks for the date of birth again, so a shared phone or tablet doesn't stay open.

A patient can only open their own portal once they are old enough to sign for themselves: 16 in the UK, 18 elsewhere.

Booking and recall messages can carry the link too: add the {{patient.portalLink}} merge tag (Patient portal link) to the message. Each message brings the patient's own link, renewed or replaced by the same rules as Send portal link; it is empty when the portal can't open for them. See The patient portal link.

Accounts

An account lets someone sign in with their email and a password instead of a link. Nobody can sign up on their own: an account always starts from you.

• Invite to portal emails an invitation that works for 7 days. It asks for the patient's date of birth (five wrong dates lock it), then a password. The invitation goes to the patient's own email, a related patient's own email, or the email you enter for a parent recorded by name.
• From a secure link, the portal offers Sign in with email next time: the person enters their email, types the 6-digit code we send there within 10 minutes, and chooses a password.

If that email already has an account at your practice, the person enters its password (and their two-factor code, when it is on) and the record is added to it — but only when the account belongs to the same person the link or invitation was for. An email shared by two people is never treated as the same person: the second one uses a different email.

Passwords are 12 to 128 characters and can't be the email or the practice's name. In the portal's Account, the holder changes their password and sign-in email, turns two-factor sign-in on or off, makes new backup codes, and signs out other devices. Changing the email sends a link to the new address, which must be used within 24 hours, and tells the old address.

Forgot your password? on the sign-in page sends a link to choose a new one, valid for 30 minutes. Ten wrong passwords in a row pause signing in for 15 minutes, and the account holder is emailed.

Parents and guardians

A parent, guardian or attorney recorded on the child's Details › Family gets portal access only when you allow it:

• When you add them, tick May receive records (patient portal).
• For someone already on the card, click Allow portal access. Their row ends and a new one starts with portal access, the same in every other way. Rows show a Portal access pill.

Who keeps access depends on the patient's age, worked out on every visit:

Tick Acts for adult: court order or power of attorney seen only when you have seen it. When access ends at the birthday, the parent's portal says the young person now looks after their own care, and the record's Patient portal suggests sending the patient their own invitation.

Ending a relationship, or changing it, stops portal access through it on the next visit. To carry an account on under the new row, use Re-link to this record in Patient portal.

A link or invitation for a parent or guardian never goes to the child's own mobile or email. For someone recorded by name only, enter the mobile or email you have just confirmed with them and tick I confirmed this with them just now. It is used for that message only and isn't added to anyone's contacts.

Manage access on the record

Details › Patient portal shows, for that patient:

• Links: each link, who it is for, its state and when it was last opened.
• Accounts: each account that opens the record or belongs to the patient, with its email and two-factor state, and any front-desk recovery.
• Invitations waiting: with Cancel invitation.

On an account:

• Remove portal access ends that account's access to this record.
• Sign out all devices signs it out everywhere.
• Disable account stops it signing in at all.
• Re-link to this record gives access back, for example after a merge.

Anyone who sends forms sends links and invitations. Anyone who can edit patients removes access, signs out devices and disables accounts.

What the portal shows

Every record a person can open shows its upcoming appointments, the forms waiting for them and any deposit to pay. Each list shows 20 at a time, soonest first; Show more shows the next 20.

Appointments

The next visits in your diary, with the time, the appointment type, the clinician and the site.

• Confirm marks a booked visit confirmed. The diary shows it as confirmed by the patient — "Confirmed by Sarah Jones in the patient portal", or for a parent "Confirmed by Mary Jones (parent) in the patient portal".
• Cancel appointment cancels it under your online booking's rules: up to the appointment type's notice (two hours unless you set another). After that, the visit says to call you. The person's access and their consent are checked again as the cancellation is made, so access you remove at that moment stops it.
• Move opens the visit's own page on your online booking, which offers the times your booking page allows and asks for the patient's date of birth before the change. It shows only while your online booking page is on.

A parent or guardian whose relationship allows portal access but not consent sees the visits but can't confirm, move or cancel them.

Forms

The forms you've sent the patient that are still open. Fill in opens the form in the portal, without the date of birth the form link asks for: the portal's own sign-in stands for it, and is checked again each time the form saves or is sent.

• Only someone who can consent for the patient can fill one in.
• A form that asks for a signature opens only for the person its link names — the patient, or the parent, guardian or attorney you chose when you sent it — and only after they confirm who they are: an account holder enters their password (and their two-factor code when it is on); someone using a secure link must have entered the date of birth within the last 15 minutes.
• If the person's access ends while they are filling it in (signed out, the relationship ended), what they send is kept for you in the review queue instead of being filed, with Try again to file it once you've checked who sent it.

Deposits

Booking deposits still to pay show with Pay, which opens the same secure payment page as the deposit's own link. They show to whoever pays the patient's account, or to the patient themselves before they have one.

Balance payments

With Balance payments on, the person who pays an account — its responsible patient, or a parent or guardian who pays it — sees, under Account balance:

• the balance and what there is to pay now. Like your statements, this leaves out what insurance is expected to pay and treatment still waiting for an estimate;
• on a family account, each member's part, to tick under Pay towards;
• the account's statements, with Download and Pay this statement. A statement opens only while everyone it names is still on your records, and each download is recorded in the activity log against everyone it names. Show older statements goes back further, past any the person can't open;
• the account's recent online payments.

Pay by card takes the payer to Stripe's payment page on your connected Stripe account. The amount can be anything from Stripe's minimum (£0.30, €0.50 or $0.50) up to what is owed now — never more, so nobody pays into credit online. With nobody ticked, what is owed now is the account's total, as its statement shows it: one member's credit counts against another member's balance. One payment at a time can be in progress on an account; Continue paying reopens it. If the patient moved to another account since the page was opened, the payment isn't started and the page asks them to check again.

Once Stripe confirms the payment, it is posted to the account as an Online payment, towards the members ticked (or the oldest items first). If another payment landed while the payer was on Stripe's page, the whole amount is still posted — the money was taken — and what the account no longer owed stays as credit, with an Online payment more than was owed task. Nothing is refunded by itself: see Online payments to refund it.

Share documents

With Shared documents on, you choose which of a patient's filed documents they can download in the portal — a report, a letter, an X-ray. Nothing is shared until you share it.

1. Open the patient's record and go to Details.
2. In Patient portal, under Shared with the patient, click Share a document.
3. Choose the document and, if useful, add a note to the patient.
4. Click Share a document.

The patient sees it under Documents in the portal, and so does a parent or guardian whose relationship allows portal access. Stop sharing (two clicks) takes it out of the portal at once, even from a download link already open on someone's screen.

• Only the patient's own filed documents can be shared. Invoices and statements belong to an account and can't be; documents marked entered in error can't be either.
• Anyone who can file documents shares and stops sharing.
• Each download is recorded in the activity log before the file leaves, with who downloaded it. A download link lasts one minute and works only for the device that asked for it: signing that device out, or the person losing access to the record, stops it.

Sign plans online

With Online plan signing on, patients see their presented treatment plans under Treatment plans in the portal. Review and sign shows the plan exactly as it was presented, with each treatment's fee.

1. The patient unticks any treatment they decide not to have (a bridge's units go together, and treatment already started can't be unticked). The total they accept updates as they go.
2. They read the statement, type their full name and sign in the box — or type to sign.
3. They confirm who they are: an account holder enters their password, and their two-factor code when it is on; someone using a secure link must have entered the date of birth within the last 15 minutes, or is asked for it again.
4. They tick that they sign electronically and click Sign and accept.

Who can sign is the same as at the desk: the patient once they are old enough to consent, or a parent, guardian or attorney whose relationship allows both portal access and consent. A parent who can see records but not consent sees the plan without the signing part. A judgement that a child can consent for themselves is only ever made at the desk, never online.

The plan is then accepted, exactly as if you had recorded it at the desk, and its header says Signed online. Smileline keeps:

• what the patient sent, first, before anything else happens: who signed and how they were signed in, the treatments they declined, their typed name, the signature, the time, and their device and internet address;
• the signature as a clinical document;
• an acceptance certificate: a PDF of the plan as accepted, with the signature, the signer, how they confirmed who they are, when, and the plan's fingerprint. It is filed on the patient's record and shared with them in the portal automatically, even if Shared documents is off.

A plan presented again, reopened, cancelled or past the date it is valid until can't be signed online. If it changes while the patient is signing, or the signer can't consent for the patient, or online signing was turned off, nothing is accepted and the patient is told why. What they sent, signature included, is still kept, and Plans signed online shows it as Not recorded with the reason.

When something goes wrong

Plans signed online in Patient portal lists each online signing with its state. Smileline keeps trying by itself when a signature or a certificate can't be finished straight away. If it still can't after several tries, the signing shows Couldn't be recorded or Accepted · certificate failed, a task asks you to retry, and Retry finishes it. A plan that was accepted stays accepted while its certificate is retried, and a patient's signature is never thrown away.

Help someone who is locked out

When a patient has lost their authenticator and has no backup codes, or can no longer use their sign-in email, anyone who can edit patients can help from Patient portal:

1. Click Reset two-factor or Change sign-in email.
2. Under How did you check who they are?, choose Photo ID seen in person, Known to us in person or Called back on the number on file, and add a note if useful.
3. For a new email, enter it.
4. Click Confirm and enter your own password again.

At once, every device the account was signed in on is signed out, and the old email and mobile are told, each with a link to undo the change for 30 days. Two-factor is off straight away; a new email works once its own link is used, when the patient also chooses a new password.

Each change on the account lists where its text to the old mobile stands: Text notice sent, Text notice waiting to send, or Text notice not sent with the reason — no texting number is connected, it failed, or the patient has opted out of texts. Fix the reason, for example by connecting a texting number, then click Send text again. After the 30 days to undo, or once the patient has used Undo, the text still goes, without the Undo link: it asks them to call the practice instead. The email to the old address goes in every case.

Undo signs everything out again, puts the old email back, and closes the account until the patient chooses a new password from a link sent only to that old email — never to the new one. It also adds a task: A patient undid a portal recovery: check who asked.

If the old email can't be put back — for example, another portal account at your practice now signs in with it — Undo still signs everything out and closes the account, which then shows Disabled. Nothing is sent to the new email. A task, A portal Undo needs you: help the patient back in, says what to do. The patient's Undo link keeps working: once the old email is free again, it finishes the Undo.

Merges and erasure

• Merging two records cancels the merged-away record's links and invitations and ends every account's access to it. An account that belonged to the merged-away record moves to the record you keep, with its access ended until you click Re-link to this record.
• Erasing a patient deletes their links, invitations and every account's access to their record, and deletes the account they held themselves. A parent's account keeps its other children.

What's recorded

The activity log shows each link sent, opened or locked, each invitation, each change to access, each recovery with the identity check, and each portal visit, recorded as the patient or parent who made it. It also shows each document shared, unshared and downloaded, each plan viewed and signed online, each appointment confirmed or cancelled, each form opened, each look at an account balance or statement, and each payment started.