Attorney-clinic document exchange portal, a technical case study

Personal injury attorneys need ongoing access to their clients' medical documentation, LOP status, and billing progress, but clinics can't reasonably give every attorney broad access to the clinic's full patient list. Historically that tension got resolved with phone calls, faxes, and manual status checks, none of which scale as caseload grows.

A dedicated attorney portal with data isolation enforced at the query level (not the UI level), scoped document access for LOPs and case files, and billing status visibility that excludes the clinic's internal notes. The result eliminated the majority of routine status-check phone calls attorneys' offices were making.

The critical design decision: filtering happens in the API layer, driven by the attorney's identity from their JWT token, not in the frontend. Every attorney-facing endpoint applies this filter before returning any data.

This matters because it removes an entire class of potential failure. A UI that simply hides other attorneys' data, while still technically returning it from the API, is one missed check away from a leak. Filtering at the query level means there's no leak to have, because the data that shouldn't be visible was never fetched in the first place.

Letters of Protection generate automatically when relevant, and become immediately accessible in the portal without a separate request. Documents are served via time-limited signed URLs, so a link that gets forwarded or cached somewhere doesn't remain a permanent access point.

Attorneys see the billing lifecycle stage relevant to their case, exactly what they need to track a settlement negotiation. They don't see internal billing team notes. This split is implemented at the API response level: the endpoint attorneys hit simply doesn't include those fields.

• A timeline view shows current milestone status directly in the portal, replacing what used to require a phone call
• Attorneys view and download; they don’t edit clinical or billing records
• Attorney-facing API routes are read-only by design, no write endpoint exists even if the frontend were bypassed

A few things became clear only after real attorneys started using the portal. Attorneys check status far more sporadically than clinic staff, sometimes daily during a negotiation, sometimes not for weeks. The portal needed to make sense to someone returning after three weeks away just as much as to daily users, which meant clear status language rather than internal clinic jargon.

Attorneys' offices also juggle cases across multiple clinics, often running different software. A portal that behaves in familiar ways reduces the learning curve for staff logging into three or four different clinic portals across their caseload.

What happens to an attorney's document access once a case settles? In Medico, closed cases remain visible with documents still accessible, since attorneys frequently need to reference LOPs and billing records after settlement, for their own file-closing process or if a dispute resurfaces. Access follows a defined retention window instead of being revoked the moment a case closes.

Clinic Admin users reported that the portal eliminated the large majority of routine attorney status-check phone calls, freeing front desk and billing staff to focus on clinic operations. Data isolation held at the query level meant zero cross-client visibility incidents across the attorneys using the platform.