Appearance
Online Report Lookup
Online report lookup lets patients retrieve finalized laboratory reports without calling reception — using credentials printed on their receipt or sent via SMS.
Patient flow
mermaid
flowchart LR
A[Receive SMS / receipt] --> B[Open public URL]
B --> C[Enter credentials]
C --> D{Validate}
D -->|OK| E[View / download PDF]
D -->|Fail| F[Generic error]Access credentials
Typically two-factor style knowledge factors:
| Field | Source |
|---|---|
| Report / invoice number | Receipt header |
| Access code | PIN, phone last digits, or lab-issued password |
| Date of birth | Optional third factor |
Exact fields depend on lab configuration in Settings — document your lab's combination on reception handouts.
SMS template
Include lab name, report number, access code, and full HTTPS URL in SMS templates. Shortened URLs should use your branded domain.
Public URL patterns
| Pattern | Example |
|---|---|
| Default slug | https://app.easelab.com/{tenant-slug}/report |
| Custom domain | https://results.yourlab.com/report |
Configure slug during registration; upgrade for custom domain.
What patients see
After successful validation:
| Element | Description |
|---|---|
| Patient name | Partially masked optional |
| Test list | Completed panels |
| Result values | Final verified data only |
| Reference ranges | As on printed report |
| PDF download | Letterhead-branded |
| Browser print friendly |
Unverified or in-progress results are not exposed.
Staff-side prerequisites
mermaid
sequenceDiagram
participant Tech
participant Verifier
participant System
participant Patient
Tech->>System: Complete results
Verifier->>System: Verify
System->>System: Mark deliverable
Note over System: Public token active
Patient->>System: Lookup
System->>Patient: Report PDF- Results verified.
report_deliverycompleted or auto-release policy enabled.- Public access enabled in lab settings.
Security controls
| Control | Purpose |
|---|---|
| No patient directory | Prevents enumeration |
| Rate limiting | Brute-force mitigation |
| HTTPS | Transport encryption |
| Token expiry | Optional link TTL |
| Audit log | Staff trace of deliveries |
Failed lookups return generic errors — do not reveal whether invoice exists.
Credential sharing
Patients sharing access codes on social media may expose PHI. Educate patients to treat codes like passwords.
API reference
Public endpoints documented in Public API:
| Method | Path | Description |
|---|---|---|
| POST | /public/report/lookup | Validate and fetch report |
| GET | /public/report/{token} | Tokenized view (if enabled) |
No Authorization header — tenant resolved from host or slug parameter.
Branding checklist
| Item | Verified |
|---|---|
| Logo renders on PDF | ☐ |
| Lab phone visible | ☐ |
| Privacy policy linked | ☐ |
| Mobile layout readable | ☐ |
| Custom domain SSL valid | ☐ |
Troubleshooting
| Patient report | Cause | Fix |
|---|---|---|
| "Not found" | Typo in invoice # | Re-read receipt |
| Not available yet | Not verified | Staff verify first |
| Old report missing | Retention policy | Provide copy from archive |
| SSL warning | Domain misconfig | Fix DNS |
| 429 error | Rate limit | Wait and retry |
Staff training script
"Your report will be ready in approximately [TAT]. When you receive SMS, open the link, enter invoice number [X] and code [Y]. Call us if you need help."