Why NCSS does not use a patient portal.

Patient portals became standard equipment for medical practices in the 2010s. We looked at what we would be adding and what we would be exposing, and made a different call. Here is the reasoning.

If you have received medical care in the United States in the past ten years, you almost certainly have a patient portal account somewhere. You may have several. They are the standard interface between patients and their healthcare providers — for appointment scheduling, prescription refills, secure messaging, test results, and access to medical records.

Newport Center for Special Surgery does not have a patient portal. We chose not to adopt one when they became the industry default around 2012, and we have chosen not to add one every year since. This piece explains the reasoning, because it comes up often enough to be worth putting in writing.

What a patient portal is, from a security standpoint.

A patient portal is a web-facing application that sits between a patient's device (phone, tablet, laptop) and the practice's clinical record system. To function, it requires:

Every one of these components is a potential point of failure. In aggregate, they represent a substantial expansion of a practice's digital attack surface. Not a small one.

What patient portals have delivered, honestly.

For the primary care and specialty medicine practices that see thousands of patients per year, portals have delivered real value. Prescription refills without a phone call. Appointment scheduling at 2 a.m. Test results delivered directly rather than through voicemail tag. Reduced administrative burden for staff.

We do not dispute this value. For a busy primary care office, a portal is a reasonable choice.

But we are not a busy primary care office. We are a surgical facility that serves a small number of patients per day, with paperwork handled primarily by the affiliated surgeon's office rather than by NCSS directly, with communication that is inherently high-touch (pre-operative consultation, day-of surgery care, post-operative follow-up), and with clinical information that is unusually sensitive (surgical planning, before-and-after documentation, private-region imagery in some cases).

The portal's efficiency benefits do not scale down to our volume in a way that justifies the security tradeoff.

What we do instead.

• Direct PDF downloads for the small number of NCSS-specific forms — sent to your email address, or provided in person at your appointment.
• Phone conversation for anything requiring back-and-forth. Our office is open Monday through Thursday, 8 a.m. to 3 p.m. Most patient questions are resolved in under five minutes on a call.
• In-person conversation for the substantive interactions — pre-operative consultation with your surgeon, Rest-Assure evaluation with Dr. Scott, day-of surgery care, post-operative follow-up.
• Your surgeon's own systems, if they operate a portal, for anything specific to their practice. That decision is theirs, not ours.

This is not a technology-averse position. NCSS uses electronic medical records, encrypted internal messaging, secure fax, and modern practice management software. What we have declined is the specific choice to add a patient-facing web portal.

The trade we accept.

The trade is real. Some patients would prefer to schedule online. Some would prefer to view their records without needing to request them. Some would prefer secure messaging over a phone call. For those patients, our operating model is less convenient than the industry norm.

We think the trade is worth it. Every year that portal breaches make news — and they make news every year — reinforces the reasoning. By not having a portal, we do not eliminate all data-security risk. Nothing does. But we have declined to add a specific and large category of risk that we have decided is not worth what it would give our patients back.

What this looks like in practice.

You will call us to schedule. You will receive PDFs by email or in person. You will speak with a human being on the phone or in the office for anything substantive. Your records live with us, not on a vendor's cloud that you access with a password. If you want copies, you request them and we provide them.

For most of our patients, this operating model is what they expected from a small, focused surgical facility, and it fits how they wanted to interact with us. For some, it is a downgrade from what other practices offer, and they let us know. We take the feedback and we do not change the position. The reasoning has held for thirty years, and we do not see a reason to accept the risk we spent thirty years declining.

H. Rand Scott, MD is founder and Medical Director of Newport Center for Special Surgery. Board-certified anesthesiologist, subspecialty training in interventional pain management at Penn State Milton S. Hershey Medical Center. He personally offers a free Rest-Assure pre-operative consultation to every scheduled surgical patient at NCSS.