Short answer: A patient portal, such as MyChart, is a secure website run by your provider or health system: it mainly shows that organization's record of your care and often lets you message, schedule and pay bills. A personal health record (PHR) app is set up and managed by you and can hold information from several providers, home devices and your own entries. Where your health system supports an app, you connect it by signing in on the health system's own page and approving what the app may read.
The U.S. Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT (ASTP/ONC, called ONC before 2024) describes a patient portal as a secure online website that gives patients 24-hour access to personal health information, such as recent doctor visits, discharge summaries, medications, immunizations, allergies and lab results, using a secure username and password. It describes personal health records as containing the same types of information as electronic health records, but designed to be set up, accessed and managed by patients, and notes that a PHR can include information from clinicians, home monitoring devices and patients themselves.
Put simply, a portal is your provider's view of your care, opened up to you. A PHR is your own record, which you assemble and control. The two are not rivals: you can keep using your portals for the things only a portal can do.
| Patient portal (for example, MyChart) | Personal health record (PHR) app | |
|---|---|---|
| Who runs it | Your provider or health system. MyChart is Epic's patient portal, and each organization that uses Epic runs its own | You. ASTP/ONC describes PHRs as set up, accessed and managed by patients |
| Whose records it shows | Mainly that organization's record of your care. Epic's Happy Together can link MyChart accounts at organizations that take part, and Care Everywhere lets your provider see information from other participating organizations | Whatever you bring in: connected portals, imported files, device data and your own notes |
| What else you can do | Often message your care team, request refills, schedule appointments and pay bills, depending on the organization | Depends on the app; check what it says it does. A PHR does not replace your portal for messaging or scheduling |
| How records get in | Your provider adds them as part of your care | You connect a portal (sign in and approve), import files, or type information in |
| Which privacy rules apply | Generally your provider's HIPAA obligations | ONC says data you send to an app you choose is no longer covered by HIPAA; the app's privacy policy and other laws, such as the FTC's Health Breach Notification Rule for PHR vendors outside HIPAA, apply |
| When you leave | The record stays with the provider; you can request a copy | Depends on the app's export and deletion options; check before you start |
A portal is the front door to one organization's electronic health record. ASTP/ONC's Get It, Check It, Use It guide tells patients that the first step in getting their health information is to check their provider's online patient portal, where they can often make appointments, contact their provider and look at lab results. ASTP/ONC also lists features some portals offer, such as secure messaging with your doctor, prescription refill requests, forms and educational materials.
Those features are the portal's real strength, and a PHR app does not take them over. Your portal is connected to the organization treating you: a message there goes to that organization's care team. If you see one health system for everything, its portal may be all you need.
The limit is scope. Each portal is run by the organization that offers it, so if you see a primary care doctor at one health system, a specialist at another and a physical therapist in private practice, your information may sit in separate places. Epic's MyChart help describes two bridges: Happy Together, which links MyChart accounts at organizations that take part, and Care Everywhere, which lets your provider see information from your record at another participating organization. Providers whose organizations do not take part are not covered by them.
A PHR app starts from the patient instead of the provider. ASTP/ONC defines a personal health record as an electronic application through which patients can maintain and manage their health information, and that of others for whom they are authorized, in a private, secure and confidential environment. That last part matters for caregivers: a PHR can hold a parent's or child's records if you are authorized to manage them.
Because you set it up, a PHR can bring together things no single portal holds: records from several health systems, files from a provider who does not use a portal, readings from a home device, and your own notes, such as symptoms or the questions you want to ask at your next visit. Depending on the app, it can also be where you export your records and decide who else sees them.
A PHR app is only as complete as what goes into it. Records you connect may be incomplete or delayed, and they may contain errors that came from the source. A PHR helps you organize and understand your information; it does not diagnose anything, and important decisions belong with your care team.
Often you no longer have to download files from every portal and upload them yourself. ONC's Cures Act Final Rule, issued in 2020 under the 21st Century Cures Act, requires certified health IT developers to provide a secure, standards-based application programming interface (API) that supports a patient's access to core data in their electronic health record. ONC says the rule supports patients' ability to get this information electronically at no additional cost, for example through the smartphone app of their choice. That is about what your provider may charge for electronic access; an app sets its own terms. Whether a given app can connect still depends on your health system: Epic's MyChart help notes that an organization might not have turned on support for a particular app.
The technical pieces have names. HL7 FHIR is the data standard. The HL7 SMART App Launch framework, often called SMART on FHIR, is how an app asks a health system for permission and receives it, building on the OAuth 2 and OpenID Connect security standards. ASTP/ONC's certification criterion for these APIs references all of them. Epic documents its FHIR APIs for app developers on its Epic on FHIR site.
For you, the steps are short. ONC's description: you connect your chosen app, prove to your provider who you are (authenticate), and then approve (authorize) the transmission of some or all of your data. In practice, the app sends you to your health system's own sign-in page; you sign in there, choose what to share, and the health system lets the app read those parts of your record.
Epic's MyChart help adds the details. Your MyChart password is never seen by an app. Before any information is shared, you must approve the sharing, usually by logging in to MyChart. Apps can request only a standard set of information called the United States Core Data for Interoperability (USCDI); you can select or clear individual information types, and the app receives only the types you approve. You also choose how long the app has access, such as one hour, one day or one year. After access ends, the app cannot receive new information unless you share again, but it can still see what you already shared.
This is the most important difference, and it is easy to miss. Your provider is generally bound by HIPAA, which applies to health plans, health care clearinghouses and health care providers that conduct certain electronic transactions, and to their business associates (45 CFR 160.103). ONC states plainly that once your data is outside your health care provider's hands, in a third-party app you chose, it will not be covered by the HIPAA Rules. An app you choose yourself is usually none of those things, which is why your health system may show a notice, when you connect, that the app may not be covered by HIPAA.
Other protections can still apply. The Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318) applies to vendors of personal health records that are not HIPAA-covered entities or acting as a business associate of one, and requires them to notify affected people, and the FTC, after a breach of security involving unsecured health information in their records. But the main thing that governs what an app does with your records is its own privacy policy and terms, so read them before you connect.
Your provider may help you decide. ONC explained in 2020 that, under the information blocking rules, providers may tell you about the privacy and security risks of an app, for example by showing a warning based on how the app's developer answered questions about its privacy policy, but generally may not prevent you from choosing to share your data with the app you want, subject to the exceptions in those rules.
Use these questions with any PHR app you are considering, including ours. Each answer should be on the app's own website or privacy policy. If you cannot find it, treat that as an answer. The right-hand column shows what PatientPower's own pages say, so you can see how one app answers.
| Question to ask | Why it matters | What PatientPower's pages say |
|---|---|---|
| Does it connect to your providers' portals through the provider's own sign-in page? | Epic's MyChart help says your MyChart password is never seen by an app; you sign in on your health system's own page | Its Epic MyChart connection is live, approved for use on 16 September 2026 (not an Epic endorsement). You sign in on your health system's own MyChart page, so PatientPower never sees the password |
| Can you add records from providers it cannot connect to? | Your care may be spread across systems that do not share one portal | Import FHIR, Blue Button, CSV or PDF files, photograph a document, or type information in |
| Do you choose what is shared, and can you stop? | Consent should be specific and reversible | You approve categories on your health system's screen; you can disconnect in PatientPower or revoke access in your health system's portal settings at any time |
| Does the privacy policy say whether it sells your data or uses it for advertising? | Data in an app you choose is governed mainly by its policy, not HIPAA | Its privacy policy says it accesses only what you authorize, never sells your health information and never uses it for advertising |
| Can you export everything and delete your account? | Your record should leave with you | Export the whole vault as a JSON or CSV file, or request deletion of your account and information at any time |
| Who else can see your record? | Sharing with caregivers or practitioners should be your decision | Records are shared with a practitioner only when you grant it, category by category and practitioner by practitioner |
| Does it change anything in your provider's record? | Your provider's record should stay under your provider's control | It only reads the records you approve and never changes anything in MyChart |
| Does it say what it does not do? | Clear limits are a sign of an honest product | It is for education and organization, does not diagnose conditions and is not medical advice |
| Does it publish privacy commitments you can check? | Public attestations let you compare apps | It publishes a CARIN Code of Conduct attestation and a Model Privacy Notice based on the format published by ONC, alongside its privacy policy |
PatientPower (beyondmychart.com) is a personal health record app, not a portal. It is designed to sit alongside your portals: keep using MyChart to message your care team, schedule appointments and pay bills, and use PatientPower to bring a copy of your records from several health systems, plus your own files and entries, into one record you control.
PatientPower's Epic MyChart connection is live: it was approved for use on 16 September 2026, and patients can connect their MyChart accounts today. That approval does not mean Epic endorses PatientPower; PatientPower is an independent app and is not affiliated with or endorsed by Epic. It asks for conditions, medications, allergies, lab results, vital signs, immunizations and visits, and what arrives depends on what each health system releases to apps and what you approve.
For the step-by-step connection, see Connect your Epic MyChart records to PatientPower. To see how PatientPower compares with MyChart, Novellia, OneRecord and Apple Health, see the side-by-side comparison. For more on app safety, see Is it safe to connect third-party apps to MyChart?
No. A patient portal is a secure website run by your provider or health system that mainly shows that organization's record of your care. A personal health record (PHR) is set up and managed by you and can combine information from several providers, home devices and your own entries. You can use both.
Yes, if you use its messaging, scheduling or billing. Your portal is where you message your care team, schedule appointments and pay bills with that organization. A PHR app brings a copy of your records together in one place; it does not replace those portal functions.
Through a patient-authorized connection based on HL7 FHIR and SMART App Launch. The app sends you to your health system's own MyChart sign-in page; you sign in, choose which information types to share and for how long, and approve. Epic's MyChart help says your MyChart password is never seen by the app.
Usually not for records you send to it yourself. ONC says that once your data leaves your provider for an app you chose, it is not covered by the HIPAA Rules. The app's privacy policy applies, and the FTC's Health Breach Notification Rule requires PHR vendors outside HIPAA to notify affected people of a breach involving unsecured health information. Read the policy before you connect.
ONC explained in 2020 that under the information blocking rules, providers may warn you about an app's privacy and security risks, but generally may not prevent you from deciding to share your data with the app you choose, subject to the rules' exceptions. Separately, Epic's MyChart help notes that if you cannot find your health system in an app, the organization might not have turned on support for that app, or the name might not match exactly.
PatientPower is a personal health record app whose Epic MyChart connection is live, approved for use on 16 September 2026 (not an Epic endorsement). You sign in on your health system's own MyChart page, so PatientPower never sees your password, and the record categories each health system releases and you approve come into one vault.