A white label patient portal is a vendor's portal, appointment requests, messaging, forms, results and payments, resold to medical, dental or therapy practices by a consultancy or an IT firm under its own badge. It is a white-label category with a rule attached: the portal handles protected health information, so the reseller is a business associate of every practice it sells to, with the obligations that brings. This page sets out what the vendor keeps, what the reseller takes on under the HIPAA rules, how the portal is priced per practice, and what the client book keeps.
What the vendor keeps behind the badge
The portal application, the hosting, the encryption, the audit logging and the integration with the practice's record system are the vendor's. The reseller's badge goes on the login, the emails and the forms. The vendor is a business associate of the practice, or a subcontractor of the reseller, depending on how the agreements are drawn, and the reseller should know which before the first practice signs.
What the reseller takes on: the business associate position
A reseller whose badge is on a portal that stores and transmits protected health information is a business associate of the practice under 45 CFR Part 164, and owes a business associate agreement to the practice, safeguards for the information it can reach, and breach notification. The vendor's own security does not remove the reseller's obligations; it satisfies some of them. A consultancy that has never signed a business associate agreement should read Part 164 before it resells a portal.
Pricing per practice, per provider or per patient
Vendors wholesale portals per provider or per practice a month, sometimes per active patient; resellers price per practice as a flat fee or per provider. The free margin worksheet on this site takes the wholesale price, the platform fee and the reseller's price and returns the margin per practice and the practices needed to cover the fee. The hours to configure each practice's forms and integrations belong in the payback line.
The client book a portal reseller keeps
Every practice with the portal resold, the providers, the wholesale and retail price, the vendor and the agreement, the business associate agreement and its date, the renewal date and the date of the last security review. Rebadgo Pro keeps that book and renders the proposal and the price sheet from it under the reseller's badge; it holds no patient information, and neither should the reseller's own records beyond the agreement.
Questions people ask about white label patient portal
Does a reseller of a white label patient portal need a business associate agreement?
Yes, with each practice it sells to, because its badge is on a service that handles protected health information. The vendor's agreement with the reseller covers the vendor's side; the reseller still owes its own.
Can a general IT firm resell a patient portal?
Yes, if it accepts the business associate obligations and can support the practice's configuration. The margin worksheet on this site says whether the per-practice terms pay for that.
Who handles a data breach on a resold portal?
Both the vendor and the reseller have notification duties under Part 164, in the order and within the times the rule and the agreements set. The client book should hold the vendor's contact and the agreement so the reseller can act within them.