A code on a report is a convenience for the patient and a liability if it is built wrong. The rule is simple: the code opens a door, it is never the key.
Make a QR code freeNot the results themselves, not a patient identifier that grants access, not a tokenised link that opens a record without authentication. Printed reports are photographed, left in bags, dropped in car parks and shared in family group chats. Anything encoded into that piece of paper is effectively public the moment it leaves the building. This is not a theoretical concern — long-lived access links printed on documents are one of the more common causes of health data exposure.
The code points at your patient portal's public entry page, optionally with a non-secret reference that pre-fills which report is being requested. The patient then authenticates as themselves — password, one-time code, or whatever your system uses — and the portal decides what they are allowed to see. Everything sensitive happens after authentication, on your side, where it can be logged, revoked and audited. The code has saved the patient typing a URL, which is the entire and sufficient benefit.
Because the code carries no access of its own, you keep the ability to do the things a printed link takes away: log who viewed what and when, revoke access when a record is corrected or a relationship ends, apply retention rules, and honour a deletion request meaningfully. A printed tokenised link defeats every one of those, and cannot be recalled once the paper exists.
Reducing the phone calls a lab receives asking where results are. Giving patients a route to historic reports without a records request. Linking a printed summary to the fuller dataset a clinician might want. Providing plain-language explanations alongside a technical report, which measurably reduces anxiety and follow-up appointments. All of these are real benefits, and all of them are available without putting a single byte of clinical data into a printed square.
Ten types, twelve designs, PNG, SVG, and PDF download. No account, no expiry, and nothing you type leaves your browser.
How clinics and hospitals use QR codes for appointment booking, patient forms, feedback and information — with the privacy limits you must respect.
ReadSix rules that decide whether a QR code gets scanned: print size, contrast, quiet zone, error correction, a call to action, and testing on real phones.
ReadA static QR code can never be changed or measured. A dynamic one can be re-pointed after printing and tracks every scan. How to tell which your campaign needs.
ReadRestaurants, packaging, out-of-home advertising, events, retail, and field services. Where QR codes earn their place, and which type each one needs.
Read