How to Deliver Lab Test Results to Patients Online

The short answer

You can deliver lab results online in a way that is convenient for patients and safe for the lab. A working setup looks like this:

1. The laboratory information system (LIS) receives data from the analyzers and, after a specialist validates it, generates a PDF report.
2. The system sends the patient a notification with no medical details: "Your results are ready."
3. The patient verifies their identity and opens the result in a personal account or through a one-time link.
4. Every action is logged: who opened which document and when.

The key rule: the result itself never travels in the open — not in the SMS text and not as an unprotected messenger attachment.

Patient portal or messenger

In practice a hybrid works well: the messenger or SMS is only the notification channel, and the result opens via a secure link on the portal. Patients get the speed of a messenger, and the lab keeps control over access.

Identity verification

Sending a result to the wrong person is the most dangerous mistake here. Verification options:

• SMS code to the phone number given when the sample was taken. Simple and familiar.
• Order number + date of birth or part of an ID document. Useful when the phone is not confirmed.
• Personal account login with a password or one-time code, for returning patients.
• Messenger linking via phone number confirmation, not just by username.

Plan separately for representatives: a child's parent, a guardian, the treating doctor. They need their own access with clear permissions, not a forwarded code.

PDFs from equipment and the LIS

Analyzers usually send data to the LIS via standard protocols such as ASTM or HL7. The PDF should not be assembled by hand — the LIS should generate it after the result is validated.

What the report needs:

• lab details, patient name, order number, sample collection date;
• reference ranges and units next to each value;
• a validation mark and the responsible specialist;
• a unique document ID or QR code to verify authenticity.

If the LIS cannot serve PDFs through an API, use an intermediate service: it picks up finished files from an export folder or database, matches them to orders and publishes them on the portal.

Notifications

• Keep the text neutral: no test name, diagnosis or values.
• Send only after final validation, not after every interim result.
• Provide resending and a fallback channel: if the messenger message is not delivered, an SMS goes out.
• Let patients opt out of notifications and choose their channel.

Protecting data in transit

• HTTPS (TLS) everywhere: on the portal, in the API between the LIS and the portal, in bot webhooks.
• One-time links with a short lifetime, tied to a session, instead of permanent public file URLs.
• Files live in private storage and are served after a permission check, never by a direct URL.
• Encryption at rest and in backups.
• An access log and alerts on suspicious activity, such as many failed code attempts.
• Compliance with local law on personal and medical data, including data residency requirements.

Common mistakes

• Sending the PDF as an unprotected messenger or email attachment.
• Putting result values directly in the SMS text.
• Using links like /results/12345.pdf that can be guessed by enumeration.
• Releasing results before a specialist validates them.
• Forgetting about children and patient representatives.