Patient portals experience measurable booking losses when load times breach 2 seconds during open enrollment windows. Traffic spikes of 4x to 8x baseline volume expose gaps in request handling, causing session drops that cut completion rates by double-digit percentages. Infrastructure choices made in advance determine whether portals stay responsive or lose revenue at peak.

Teams commonly provision for average daily traffic and apply single-layer caching across all endpoints. This leaves personalized data paths unprotected and fails to isolate static assets from dynamic patient records, producing latency spikes once concurrent sessions exceed planned capacity.

Cap Non-Essential Requests to Maintain Under 800KB Total Transfer Size

Performance budgets start with asset classification. Static images, fonts, and scripts must stay below 400KB combined. Dynamic HTML and API responses receive separate limits of 300KB. Any third-party tag that pushes total weight past 800KB is deferred or removed. Teams audit the waterfall weekly and remove any script whose execution exceeds 150ms on 4G connections. This rule keeps time-to-interactive under 1.4 seconds even when request volume doubles.

Apply Rate Limiting Thresholds of 200 Requests per Minute per User Session

Portal APIs require per-session caps to prevent single accounts from exhausting shared resources. Set the limit at 200 requests per minute for authenticated users and 50 for unauthenticated traffic. Exceeding the threshold returns a 429 with a retry-after header of 30 seconds. Logging these events feeds autoscaling signals. The threshold protects database connections during enrollment surges without blocking legitimate multi-tab usage.

Select Team Structure Using the Decision Matrix Below

Development velocity and burst capacity depend on the model chosen for core platform work. The following matrix guides the choice based on speed, cost exposure, and scaling needs during known high-traffic periods.

Set Cache Invalidation Windows Between 60 and 300 Seconds for Appointment Data

Static content receives long TTL values of 24 hours. Appointment availability and eligibility checks use shorter windows between 60 and 300 seconds. Invalidation occurs through event-driven hooks rather than time-based polling. When a schedule change publishes, the cache layer purges only the affected keys. This pattern keeps cache hit rates above 85% during peak hours while ensuring patients see updates within one minute of any backend change.

Teams that follow these four rules report stable p95 response times below 800ms at 6x load in controlled load tests. The combination of strict budgets, rate limits, model selection, and segmented caching removes the primary failure points observed in enrollment windows.

Siterea implements these exact patterns in patient portal builds, starting with a current traffic audit and budget definition.