Top 10 patient portal development companies in 2026

TL;DR

This guide ranks the top 10 patient portal development companies of 2026 on five things a buyer can verify: shipped patient-facing systems that handle protected health information, EHR and payment integration depth, accessibility and security posture, verifiable public clients, and fit by project size. Mercury Development takes the first spot for health systems and physician groups that keep their own compliance program and need a portal built on the systems they already run: a 100% HIPAA compliant claims workflow system in production since 2006 and now on its fourth major release, a 510(k) FDA-cleared imaging application moved to HIPAA-compliant multi-user web access in 3 months, WCAG 2 level AA+ apps, 500+ engineers with 100+ QA engineers, and delivery since 1999. The other nine, from ScienceSoft to Orangesoft, are ranked by portal-specific work, integration evidence and the budget they fit. Every card except our own carries a watch-out, and every third-party number has a named source.

The patient portal market in 2026

Patients already use portals. The question is whose. ASTP/ONC's 2024 data brief reports that 77% of individuals were offered online access to their medical records and 65% accessed a portal at least once in the past year. 57% of those who accessed records did it through a smartphone app, up from 38% in 2020, while web-only access fell from 60% to 42% over the same period. 59% had portals with more than one organization, and only 7% used an app to organize them.

The vendor market behind those numbers is growing but small relative to the software it fronts. Grand View Research sizes the global patient portal market at $4.9 billion in 2026 and projects $10.7 billion by 2033 at a 12.0% compound annual growth rate, with providers holding more than 56.5% of end use.

Read those two sources together and the buying decision changes shape. Your patients already have a portal from their primary care provider, their insurer and their lab. A tenth login does not get adopted. What gets adopted is a front end that pulls from the systems you already run, works on a phone, and lets a parent or adult child act for the patient. That is an integration and access-model job, which is why this list is about development companies rather than portal products.

Three dates that decide what your portal has to do

The first date is accessibility. On May 7, 2026, HHS extended the compliance deadline for web content and mobile app accessibility under Section 504 of the Rehabilitation Act: recipients of HHS funding with 15 or more employees now have until May 11, 2027, and smaller recipients until May 10, 2028, to meet WCAG 2.1 level AA. A patient portal is web content and a mobile app by definition, so the vendor you hire is building to that standard or building something you will rebuild.

The second is payer data. Under the CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, impacted payers must add prior authorization information to their Patient Access API and stand up Provider Access, Payer-to-Payer and Prior Authorization APIs by January 1, 2027. A portal that shows patients where a prior authorization stands has a FHIR endpoint to read from next year; the build should assume it.

The third is already in force. The information blocking disincentives rule took effect July 31, 2024. A hospital found to have blocked information loses three quarters of its annual market basket increase under Medicare Promoting Interoperability, a MIPS clinician scores zero in that category, and an ACO participant can be removed from the Shared Savings Program. A portal that hides test results or delays record release is now a revenue problem, not a design choice.

How we evaluated

Every company was scored on the same five criteria, and each one is visible in the cards below:

1. Shipped patient-facing work with protected health information: named systems in production, with what they do.
2. Integration depth: EHR vendors and FHIR standards named on the company's own pages, payment and messaging integrations.
3. Accessibility and security posture: WCAG work, attestations in the vendor's own name, HIPAA wording as the vendor states it.
4. Verifiable clients: names the company publishes itself, not in a third-party ranking.
5. Fit by budget: from a single-purpose patient app to a multi-tenant engagement platform.

Facts come from each company's own pages, fetched in September 2026, and from the two rankings that answer this query today, by Classic Informatics and Space-O Technologies. Where a company publishes no founding year or team size, the card says n/a. EHR vendors whose portal ships with their own product, such as eClinicalWorks and NextGen Healthcare, are excluded: they sell a product, not a development service.

The top 10 at a glance

1. Mercury Development

Mercury Development earns the first position on production history with patient data rather than on a portal template. The anchor is Precision Practice Management, a medical billing company serving doctors and hospitals in 14 states. Its claims follow-up runs on a 100% HIPAA compliant client-server system Mercury Development built on MS SQL and C#.NET, in production since 2006 and now on its fourth major release. Later releases added patient statements and custom delinquency letters per practice rules, the billing side of what a portal shows a patient. Confidential patient information moves over a secure channel and is never stored on the user side.

The second case is EyeIC. MatchedFlicker is a 510(k) FDA-cleared application that displays changes between serial retinal images. In March 2011 Mercury Development moved it from a Windows desktop product to a web-based, multi-user platform with HIPAA-compliant online access and centralized secure storage for patient images, finishing in 3 months. A third, 1in4, is a Flutter app for people going through infertility, miscarriage, surrogacy and adoption, with private chat, community forums, health tracking tools and reminders: a patient-facing product where the users are not clinicians.

Two capabilities matter for the dates above. Mercury Development has built WCAG 2 level AA+ compliant mobile and web apps, including ADA compliant apps for dental insurance, and works with third-party accessibility auditors. Its web practice, running since 2008, builds on Azure with .NET and MS SQL, AWS with Ruby and Postgres, and TypeScript front ends in React or Angular, the range most hospital IT departments already own. What Mercury Development does not sell is an EHR, a white-label portal product or a compliance program. The buyer keeps the compliance officer; Mercury Development supplies the software team and the 100+ QA engineers who embed into the client's process and use the client's tools.

Best for: Health systems, physician groups and health IT vendors extending an existing digital estate with a patient-facing layer, on a stack their own IT can maintain. Facts: Founded 1999; HQ Fort Lauderdale, FL (offices in Miami, Chicago, Cleveland, Belgrade, Buenos Aires); 500+ engineers, more than 1,500 completed projects, more than 40 million users of its applications; all work is work-for-hire and the customer owns the code and all underlying IP; Clutch 5.0; public healthcare clients Precision Practice Management, EyeIC and 1in4. Watch-out: If you want a prebuilt EHR connector or a vendor-held SOC 2 report, pair Mercury Development with an integration engine or pick an attested shop below.

2. ScienceSoft

ScienceSoft is the only company here that publishes a portal price on a service page: $100,000 to $250,000+. Its feature list runs from lab results to online bill payment and refill requests, under FHIR, HL7 and CDA. A published case study describes an athenahealth-integrated telehealth portal for a New York multi-practice group: 10 days of discovery, 4 weeks to design, 8 months to full implementation, more than 1,500 patients three months after launch.

Best for: Provider groups that want one contractor to deliver the portal and the compliance documentation, with a price anchor before the first call. Facts: Founded 1989; HQ McKinney, TX; over 750 IT professionals; ISO 9001, ISO 27001 and ISO 13485:2016; 4,300+ completed projects. Watch-out: Healthcare is one vertical among many at a 750-person generalist, and the case study client is anonymous, so ask for a portal reference you can call and price the documentation scope apart from the code.

3. Itransition

Itransition frames portals as a feature set: records access, care team messaging, self-service for appointments and prescriptions, and online payment per medical event, with HIPAA and GDPR compliance named. The firm is large: 3,000+ professionals and 1,530+ projects, with offices in Decatur, Georgia and London, and a Clutch rating of 4.9 on 42 reviews. Its about page displays ISO/IEC 27001:2013, ISO/IEC 15408:2009, ISO 9001:2015, PCI DSS, HIPAA, GDPR, FIPS 140-2 and OWASP badges.

Best for: Payers and hospital systems where the portal is one workstream inside a broader modernization program and bench depth matters more than a boutique fit. Facts: Founded 1998; offices Decatur, GA and London, UK; 3,000+ professionals; ISO/IEC 27001:2013, ISO 9001:2015 and PCI DSS badges; Clutch 4.9 on 42 reviews. Watch-out: Neither page names an EHR vendor, states a SOC 2 or HITRUST attestation, or shows a portal case with numbers, so the evidence is scale and certificates rather than portal depth.

4. Mindbowser

Mindbowser names more EHRs on its portal page than anyone else here: Epic, Cerner, Athenahealth, eClinicalWorks, NextGen Healthcare, OpenEMR and Open Dental. Behind that sits ConnectHealth, an integration engine with prebuilt connections to Epic, Cerner and athenahealth and 20+ EHRs in total, supporting FHIR R4, HL7 v2, SMART on FHIR and C-CDA, deployed inside the client's own AWS VPC so PHI stays in the client's environment. The company states it is SOC 2 Type II audited with 200+ HIPAA and FHIR trained professionals.

Best for: Digital health companies and provider groups whose first portal milestone is reading from and writing to an EHR. Facts: HQ Jersey City, NJ; 200+ staff; SOC 2 Type II audited; 250+ projects. Watch-out: The site publishes no founding year, no payment feature on the portal page and no portal case with outcome numbers; the 30 to 40% engineering-time claim for prebuilt components has no published method.

5. Chetu

Chetu has the most complete portal feature inventory on any page we read: registration and authentication, scheduling, chat and SMS messaging, a payment gateway with PCI-compliant online bill pay, patient engagement reporting, custom forms, EPCS-certified eRx refills and WebRTC video. Interfaces are named by vendor: Epic, Allscripts (now Veradigm), Athena Health, Kareo and NextGen for EHR; LabCorp and Quest Diagnostics for labs; Surescripts and DoseSpot for eRx; HL7, FHIR and CCDA as standards.

Best for: Practices and health IT vendors that need every portal module wired to named third parties from one large bench. Facts: Founded 2000; HQ Sunrise, FL; over 2,800 developers; offices across the US, Birmingham, England and Noida, India. Watch-out: The portal page publishes no price, no named client and no outcome numbers, and the attestation Chetu announces is SOC 1 Type 2, which covers financial controls rather than security.

6. Glorium Technologies

Glorium Technologies lists personal health records, prescription services, telehealth, self-service, an educational database, feedback aggregation and insurance and payment flow as its portal scope. The one published portal-adjacent case is Turtle Health, an at-home fertility testing system with patient, doctor and admin portals on Angular, Spring Boot, MS SQL and AWS, where operational speed increased by 2 times.

Best for: The regulated back end and admin side of a portal, where hosting posture matters more than consumer UX. Facts: Founded 2010; HQ Houston, TX; delivery in Kraków, Paphos and Kyiv; ISO 9001, 13485 and 27001; HIPAA, HITRUST and GDPR compliant development stated; 150+ products; Clutch 4.8 on 29 reviews. Watch-out: The portal page names no EHR vendor or FHIR standard, and delivery runs largely from Eastern Europe, so settle data residency and staff access to PHI in the BAA before kickoff.

7. Classic Informatics

Classic Informatics is the author of one of the two rankings that currently answer this query, and its own service page is more specific than its ranking: custom portal build, EHR integration, portal modernisation, mobile portal apps, secure messaging, billing and payments, with HIPAA, HL7 and FHIR scoping and audit logging named. Healthcare work it publishes includes a BI application for InterDent's 200+ dental clinics and a joint replacement care platform for 360 Med Care across 17,350 cases.

Best for: Modernising an existing portal or wrapping one in a mobile app on a mixed onshore-offshore budget. Facts: Founded 2002; HQ Gurugram, India, with offices in Chandigarh and Sydney; 3,000+ projects; 30+ countries. Watch-out: No EHR vendor, certification, team size or price appears on its pages, and none of the published cases is a patient portal, so ask for one before you sign.

8. Arkenea

Arkenea is the healthcare-only firm here, and its position is that HIPAA is an architectural decision rather than a checkbox. Its portal guide is the most technically specific document any company on this list has published on the subject: FHIR R4 with US Core 6.1.0 and SMART App Launch 2.0.0 for EHR access, tokenized payment fields, and a cost range of $120,000 to $450,000 over 5 to 12 months for a custom portal, or $80,000 to $140,000 in 4 to 6 months for an MVP. Named work includes a patient engagement and telehealth platform for Cumberland Health.

Best for: Provider organizations that want a small team which has never built anything but healthcare software. Facts: Founded 2011; team of over 50; address in Cary, NC; 150+ projects; named clients Novo Nordisk, Cumberland Medical Center, ORLink. Watch-out: No SOC 2, ISO or HITRUST attestation appears on the site, the cost figures live in a blog post rather than a service page, and a 50-person team caps how many workstreams run at once.

9. Appinventiv

Appinventiv lists patient portals as a sub-offering of a healthcare practice that claims 500+ healthcare platforms delivered, with HL7 and FHIR standards and ISO 27001 and ISO 9001 certification stated. Its portal guide publishes cost tiers: $40,000 to $90,000 for a basic portal in 3 to 4 months, $90,000 to $250,000 for an integrated portal in 4 to 7 months, and $250,000 to $400,000+ for an enterprise deployment in 7 to 12+ months.

Best for: Buyers who want a large offshore bench and a published cost tier to anchor procurement. Facts: Founded 2015; HQ Noida, India; 1,700+ staff; offices in New York, London, Dubai, Calgary and Australia; ISO 27001 and 9001. Watch-out: No portal-specific case with outcomes is published, Epic and Cerner appear as partner logos rather than stated integrations, and the team count differs between pages (1,600 versus 1,700+), so verify the healthcare headcount you are actually buying.

10. Orangesoft

Orangesoft is the mobile-first shop on the list. Its healthcare page publishes a general cost range of $70,000 to $350,000 and an MVP timeline of 4 to 6 months, and its portal guide narrows that to $100,000 to $200,000+ over roughly 4 to 12 months, with FHIR API, HL7 v2, CCDA and Direct Messaging for records and Stripe, InstaMed and Elavon for payments. A published virtual hospital case pairs patient and doctor apps with DoseSpot, Twilio, HealthKit and a DICOM viewer.

Best for: Telehealth-first portals where the patient experience is a phone app and video is in the first release. Facts: Founded 2011; US and Poland; 100+ specialists; ISO 9001:2015; 300+ products; Clutch 4.9 on 42 reviews. Watch-out: There is no dedicated portal service page, the case client is unnamed, and ISO 27001 and SOC 2 appear on its healthcare page as standards it builds to, with no certificate or report referenced.

Which company fits your project

Ranking is one thing. Fit is another. Match the job to the shop.

What patient engagement buyers told us before hiring anyone

Most rankings stop at the list. Here is what the demand side looks like from the inside. Through September 2026, Mercury Development reviewed tagged statements from sales calls, emails and briefs across the healthcare companies that evaluated custom development with us, including hospitals, physician groups and health IT vendors building patient engagement and portal products. A pattern counts below only when at least three companies showed it independently, no client is identifiable, and shares are rounded because a supplier's records are a sample and not the market.

Nobody was starting from zero. Around 85% of the patient engagement buyers in our records were extending something that already existed: a hospital website, a practice site with an EHR vendor's portal behind it, a live service platform, a member and provider portal estate, a shipped iOS app that needed an Android twin. Their first question was whether we could build on top of what they had.

Integrations were named before scope was. Around 50% arrived with specific third-party systems already in the requirement: an EHR vendor's portal, a scheduling data source, an SMS and video vendor, purchased third-party tools the app had to embed. The risk in those engagements sat in the systems the buyer did not control.

Client-side dependencies stalled delivery as often as code did. In around 50% of these engagements we flagged a dependency on the buyer's side as a schedule or budget risk before signing: an API that was still changing, educational content that had not been written, a backlog and start date that did not exist yet. Quoted budgets in this part of our pipeline ran from about $15,000 for a single-purpose patient education app to about $75,000 for a multi-service engagement layer covering scheduling, communication and forms.

Put all three on the agenda when you interview any company on this list.

Why proxy access decides whether your portal gets used

Opinion, with the mechanism. Most portal builds assume one login equals one patient. The data says otherwise. In the 2024 ASTP/ONC survey, 51% of portal users accessed records for someone they care for, more than double the 24% who did so in 2020. Half of your users are a parent, an adult child or a spouse, and the access model has to know that.

Proxy access is hard because it is three problems wearing one name. Identity: who is this person and what did the patient consent to. Scope: which records a proxy sees, which they never see, which change when a minor turns a certain age under state law. Audit: every proxy read is a disclosure that the audit log has to attribute to the proxy, not the patient. Get it wrong and you either block the caregiver, who calls the front desk, or you leak, which is a breach.

This is why we scope the integration and access model before the feature list. Every company on this list can build a messaging screen. Fewer can tell you how a grandmother with power of attorney reads her husband's lab result without seeing the note his psychiatrist wrote. Ask that question in the first call. The answer tells you who has shipped a portal that people actually used.

Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline, estimate and delivery records behind this article's buyer data sit in the operations he oversees.

Extending a portal or replacing one? Get the integration map before you shortlist

Most teams pick a vendor before anyone has written down which systems the portal reads from and who logs in on whose behalf. Send us your current stack, your patient roles and the systems that hold the data. We will map the integrations, the access model and the first release, so you can compare any shortlist on one scope.