Patient portal development cost, features and build steps in 2026
TL;DR
Patient portal development cost in 2026 runs from $30,000 to more than $1,000,000 across eight vendor guides, for a product they all describe with roughly the same feature list. The spread is not quality. It is scope: whether the quote contains EHR integration, proxy access, accessibility work and the compliance under all of it.
- Seven of the eight guides publish a tier inside $80,000 to $250,000 once integration is in the number.
- EHR integration alone is priced at $20,000 to $100,000, depending on the EHR.
- HHS funding recipients with 15 or more employees owe WCAG 2.1 level AA by May 11, 2027.
- 51% of individuals reached a record for someone they care for in 2024, so proxy access is identity work.
- Budget the run year, at 15 to 25% of build cost, before you sign the build year.
The portal you are quoting against already exists
Your patients are not waiting for their first portal. ASTP/ONC's 2024 data brief reports that 77% of individuals were offered online access to their records and 65% used a portal at least once in the past year. Among those users, 57% went through a smartphone app, up from 38% in 2020. And 59% already hold records with more than one organization.
The supply side is just as built out. ASTP's hospital brief puts 99% of non-federal acute care hospitals on electronic record viewing, 92% on secure messaging and 70% on FHIR based app access.
So you are buying a reason to use your login on top of APIs that mostly exist. That is an integration purchase, which is why honest quotes for one scope sheet differ tenfold.
Three 2027 dates that are already in your budget
Accessibility has a deadline and a standard. On May 7, 2026 HHS extended the Section 504 deadline: recipients of HHS funding with 15 or more employees have until May 11, 2027 to meet WCAG 2.1 level AA, smaller ones until May 10, 2028. A portal is web content and usually a mobile app.
Payer data is next. Under CMS-0057-F, impacted payers must run Provider Access, Payer-to-Payer and Prior Authorization APIs and add prior authorization status to the Patient Access API by January 1, 2027. If your portal shows where an authorization stands, it has a FHIR endpoint to read from.
The third date moved. The HIPAA Security Rule overhaul proposed in January 2025 would require ePHI encryption, multi-factor authentication and penetration testing. OCR's regulatory agenda lists final action for July 2027. Build to those safeguards now and the rule does not reprice you.
How we compared the published numbers
- A price counts only if the vendor publishes it on its own live page, in its own tier names.
- Every page was reread in November 2026 and is linked below.
- Our own figures skip any group under three data points and round shares, because a supplier's records are a sample.
Mercury Development sells healthcare software development, so one section is our own data.
Published patient portal cost bands at a glance
| Published guide | Lowest published tier | Highest published tier | Published timeline |
|---|---|---|---|
| RaftLabs | $30,000 to $60,000, basic | $120,000 to $200,000+, enterprise | 10 to 24 weeks |
| Appinventiv | $40,000 to $90,000, basic | $250,000 to $400,000+, enterprise | 3 to 12+ months |
| Space-O | $40,000 to $80,000, standalone | $350,000 to $500,000+, enterprise | 2 to 18 months |
| Orangesoft | $60,000 to $110,000+, basic | $100,000 to $180,000+, full | 4 to 12 months |
| Halkwinds | $80,000 to $120,000, entry | $200,000 to $300,000+, enterprise | 12 to 24 weeks |
| Arkenea | $80,000 to $140,000, focused MVP | $400,000 to $800,000, commercial product | 4 to 20 months |
| TactionSoft | $80,000 to $200,000, basic web | $500,000 to $1,000,000+, enterprise | 4 to 20 months |
| ScienceSoft | $100,000 to $250,000+ | not tiered | not published |
A floor and a ceiling more than thirty times apart. Seven of the eight publish a tier inside $80,000 to $250,000. The exception, RaftLabs, puts its full-featured tier at $60,000 to $120,000.
Arkenea says it plainly: quotes below $80,000 for a portal touching a live EHR generally exclude integration, compliance work, or both.
Integration is the line item that moves the number
RaftLabs puts EHR integration at 30 to 40% of development time. Space-O prices it per system: $40,000 to $100,000 for Epic, $35,000 to $90,000 for Cerner, $30,000 to $75,000 for Meditech and $20,000 to $50,000 for a generic HL7 FHIR connection. Arkenea adds $15,000 to $45,000 for each further integration.
Direction of data flow is the whole estimate. Halkwinds moves a portal from entry to mid tier largely by making one EHR connection bidirectional, and to enterprise by adding multi-EHR federation. Reading over FHIR R4 is close to routine. Writing back is a different contract.
Three questions decide the number, and they belong in the RFP. Which systems hold the data. Whether each one is read, write or both. Which system wins when two disagree.
Proxy access and accessibility are design work, not features
In the ASTP/ONC survey, the share of individuals who reached the record of someone they care for went from 24% in 2020 to 51% in 2024. Proxy is three problems under one word. Identity: who this person is and what the patient consented to. Scope: which records a proxy sees, and which change when a minor reaches an age set by state law. Audit: every proxy read is a disclosure attributed to the proxy. TactionSoft and Halkwinds both price it as identity work.
Halkwinds puts WCAG 2.1 AA at 10 to 15% of front-end cost and retrofitting compliance at two to three times. TactionSoft prices a pre-launch audit at $5,000 to $20,000. We have built WCAG 2 level AA+ compliant mobile and web apps and pass audits with third-party accessibility experts. Ask any vendor who signs off on theirs.
Release one and the order you build it in
Every guide names the same core set: records and results, scheduling, secure messaging, refills, bill payment, record download. What matters is which of those touch a system you do not own. Bill pay belongs to a processor: use a hosted field so you hold a token, not a card. Telehealth video, symptom checkers and multi-EHR federation sit in the top tier of every band above and can wait.
Most repricing traces back to a step taken out of turn.
- Inventory systems and roles: who logs in on whose behalf and what each role may see.
- Settle read versus write per integration and get a sandbox you can test on your schedule.
- Design to WCAG 2.1 AA and the proposed Security Rule safeguards from the first screen.
- Ship the smallest release worth a login and measure use before funding the next tier.
- Price the run year in the same document as the build year.
What the portal costs after launch
Published run costs disagree more than build costs do. The rule of thumb is close: TactionSoft says 15 to 20% of build cost a year, Space-O 15 to 25%, Arkenea 18 to 25%. The dollar figures are not. RaftLabs puts hosting at $500 to $2,000 a month and maintenance at $1,500 to $5,000 a month. TactionSoft totals annual operating cost at $146,000 to $441,000.
Both are plausible. One clinic on one EHR runs near the bottom; a multi-facility estate with a mobile app and annual penetration tests runs near the top. Ask which one your quote assumes.
Which band your project lands in
| Your situation | Realistic band | What decides it |
|---|---|---|
| Patient layer on an estate you run, one read-only EHR feed | $30,000 to $90,000 | How much data already has an API |
| First custom portal, bidirectional EHR, web plus responsive | $80,000 to $250,000 | Write-back scope and identity model |
| Portal plus native iOS and Android apps | add $30,000 to $80,000 | Whether cross-platform is acceptable |
| Multi-facility or multi-EHR, telehealth in release one | $250,000 and up | Number of source systems |
| Any of the above, compliance added after the build | two to three times the original | Nothing you can negotiate afterwards |
What our own patient engagement records show
Our own numbers, counted by hand from healthcare patient engagement and portal account records. They describe who asked us and what got in the way, not market prices.
Around 65% of these buyers were extending something that already existed: a practice website with an EHR vendor's portal behind it, a live service platform, a member and provider portal estate, an iOS app that needed an Android twin. Integration, not screens, drove our scoping.
Around 50% had a client-side dependency we flagged as a cost or schedule risk before signing: an unstable client API, late or wrongly formatted content, a missing backlog or start date. None of those is engineering. All of them show up in the invoice.
Why the cheapest quote is usually the least complete
A portal quote is a claim about how much of the surrounding estate the vendor will touch. The cheapest bid usually assumed the fewest integrations, the simplest access model and somebody else's compliance program.
Test it with one question: what happens to the number if the EHR connection has to write as well as read. A vendor who has shipped against a live EHR answers with a range and a reason.
Portals also do not end. The claims workflow system we have run for a medical billing client since 2006 is on its fourth major release and 100% HIPAA compliant. We also built the original desktop version of a 510(k) FDA-cleared imaging application and then moved it to HIPAA-compliant web access in three months. For the vendor view, see our ranking of patient portal development companies.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The account records behind this article's patient engagement figures sit in the operations he oversees.
Send us the systems your portal has to read from
Tell us which systems hold your data, who logs in on whose behalf, and what release one has to do. We will come back with the integration map, the access model and a band we can defend, so you can compare any shortlist against one scope.