Secure Web Portal for Patient File Transfer

The public part of the website already exists at [login to view URL], matching the same style and format we are looking to build a portal for referring doctors to fill out a patient profile and upload patient records. The website will utilize MySQL and PHP and must allow a referring physician to accomplish the following: - Register for an account by providing name, office/business name, phone number, and e-mail address - Confirm account prior to allowing login by sending e-mail with clickable link - Login, registration, and all account details would be sent in HTTPS session - Logged in area would allow viewing/selecting current, adding new patients, or archiving old patients - Adding a patient would consist of a one page form that would store it's information in the MySQL DB along with a multi-file upload similar to the one shown here: [login to view URL] - The form mentioned above would be shared between the admin version (mentioned below) and the referral and would feature an area to add comments as well as track the history of changes to the patient record or uploaded files - Southwest Endo would be able to configure one or more e-mail addresses which would get notifications when new documents were uploaded or changes were made to patient's records or comments were added however NO information about the patient would be in the e-mail, only a link to login to the portal at the admin level to see all patient records - A session timeout warning message would warn the user prior to the user being taken to a page that notifies them that their session has timed out and that they will need to login again for security measures. - A failed password during login three times within a configurable amount of time (default of 10 minutes) will lock the account and send an e-mail, clicking the link in the e-mail unlocks the account and allows the user three more tries, waiting 10 minutes also clears the account - A forgot password link will allow the user to type their e-mail address and if found will send them an e-mail with a link that they will use to set a new password. - All passwords must meet the minimum complexity requirements below: 1. Be at least 8 characters in length 2. Contain at least three of the following: A. uppercase B. lowercase C. number D. symbol