Why Patient Portals Must Separate Login Authentication from Data Consent Records

Healthcare patient portals should treat user authentication and data-use consent as two distinct technical processes, not a single login event, according to software architecture guidance. While delegated login via OAuth can verify a user's identity, the portal itself must independently record which consent policy version a patient accepted, for what purpose, and at what time. Consent records should be append-only, tied to a stable patient identifier, and never modified — with policy updates creating new records rather than overwriting old ones. Password recovery restores account access but must not imply or renew consent, and a successfully authenticated session can still be blocked from protected data if valid consent is absent. This separation ensures that audit trails can reconstruct both identity verification and informed consent decisions without relying on transient browser state or third-party identity-provider logs.