Ask a patient in Pakistan how they would like their report and the answer is almost always the same: send it on WhatsApp. Not a portal, not an email, not a second trip to the counter.
Labs have followed, and most now deliver reports this way. What has not kept up is the procedure around it — because a workflow that grew organically out of "just send it to her" tends to be missing the parts that matter when something goes wrong. A report sent to the wrong number is not a small administrative slip; it is a disclosure of someone's medical information to a stranger.
This is the practical procedure: how it works today, what to get right, and what to avoid. We build online lab reports into A Pulse Solution, and one thing to state up front — automated WhatsApp delivery is planned for our Premium plan and is not live today. Everything described here is the manual workflow, which is what almost every lab is actually running.
Why WhatsApp Became the Delivery Channel
Worth understanding, because it explains why patient portals keep failing here.
WhatsApp is already installed on the patient's phone and already the way they communicate with everyone else. There is nothing to download, no account to create, no password to forget and no support call when they forget it anyway. A PDF arriving in a chat is a document they can find again in six months by scrolling, and forward to their doctor in one tap.
Compare that with a portal login used twice a year. The portal is better on paper — access control, audit trail, no file leaving the lab's system — and worse in practice for an independent lab, because a meaningful share of patients will never successfully log in, and the ones who do will phone you about it.
The result is that in this market, delivery means sharing a file. The job is to do it properly rather than to wish patients wanted something else.
The Workflow That Works Today
Five steps. The discipline is in the first and the last.
1. Capture and confirm the number at registration. Read it back to the patient while they are standing at the counter. Every delivery problem downstream — wrong recipient, undelivered report, an angry phone call — is cheaper to prevent here than to fix later. Four seconds.
2. Generate the branded PDF from the system, after the result has been approved. Not a photograph of a printout, not a screenshot: the actual PDF, with your logo, the reference ranges and the flags on abnormal values.
3. Send from the lab's own WhatsApp Business number, not from a staff member's personal phone. This matters more than it sounds and is covered below.
4. Name the file so it can be found later. A file called report.pdf is unfindable in a
patient's chat history six months on, and indistinguishable from every other report in your
own sent folder. Something like LabName_PatientName_CBC_2026-09-07.pdf costs nothing and is
still useful next year. Avoid putting the national ID number in a filename — it travels with
the file wherever it is forwarded.
5. Keep the master copy in the system. The WhatsApp message is a delivery, not a record. The report lives in the patient's file, which is where a reprint comes from when they ask in March.
Privacy Rules That Keep It Defensible
Short list, and none of it is burdensome.
Send only to the number confirmed at registration. Never to a number relayed by a relative on the phone, and never to a number someone remembers. If the patient wants it sent elsewhere, get that from the patient.
Be deliberate about shared family numbers. One phone often serves a household here. For sensitive results, the difference between "sent to the patient" and "sent to the family phone" can be enormous — and the patient may not have thought about it when they gave the number. Where there is any doubt, offer counter collection instead, and ask rather than assume.
One patient per chat. Never a group. Obvious when stated, and it happens anyway when someone is moving quickly.
Decide who is authorised to send reports — a named role rather than "whoever is free". It keeps sensitive documents in the fewest necessary hands and makes questions traceable when one arises.
Check the chat before you attach. The most common real-world error is not choosing the wrong number from scratch; it is sending into the conversation that happened to be open, or picking the wrong name from a list of similar ones. A two-second look at the name at the top of the screen prevents it.
Do not let reports accumulate on personal devices. If staff send from their own phones, your patients' reports are sitting in personal photo galleries and chat backups, on devices you do not control and cannot wipe when that person leaves.
Why a Business Number Beats a Personal One
Four concrete reasons, beyond the general principle.
Continuity. When the receptionist leaves, the lab's delivery history and the ongoing conversations leave with them if the number was theirs. Patients also keep messaging the former employee.
A professional identity. A WhatsApp Business profile carries the lab's name, address and hours, so the patient sees who is messaging them rather than an unknown number.
Separation. Staff are entitled not to have patients messaging them at midnight on their personal phone, and patients are entitled to reach the lab rather than an individual.
Control. The lab decides who has access to the account and can revoke it.
WhatsApp Business is free and takes a few minutes to set up. Practical settings worth configuring on day one: a greeting message, an away message with your actual hours, and a few quick replies for the questions you answer twenty times a day.
Common Mistakes
Sending a screenshot or a photo of the printout. It is unreadable when zoomed, it prints badly when the patient needs paper, it loses the reference ranges at the margins, and it looks like something assembled in a hurry. Send the PDF.
Sending before the result is approved. Once a report leaves the building you cannot retrieve it — you can only issue a correction and explain. The approval step exists precisely to sit between entry and delivery.
Broadcasting or bulk-sending. Reports are individual documents. Anything that treats them as a batch will eventually attach the wrong one to the wrong person.
No record of what was sent to whom. If the master copy only exists in a chat, the lab cannot answer a question about its own report a month later.
Assuming delivered means read. For a critical value, WhatsApp is not the notification. Phone the referring doctor. The message is a convenience for routine results, not a substitute for clinical urgency.
What Is Coming, and What Is Not
Automated WhatsApp delivery is on our roadmap for the Premium plan, and it is not available today. When someone tells you their system "sends reports automatically", ask the follow-up question — does the system send it, or does a staff member send it from inside the system? — because the second is frequently described as the first, by many vendors, and it changes both the staffing and the price comparison.
Also worth knowing about, at the other end of the same problem: QR verification on reports (Premium in our plans) lets a doctor, employer or another lab confirm that a document was genuinely issued by your lab. Once reports are shareable files, they are also forgeable files, and a code that answers "is this real?" protects the honest lab as much as the receiver. The wider picture is in how online lab reports work.
Frequently Asked Questions
Is it legal to send lab reports on WhatsApp in Pakistan? It is standard practice and widely done. The obligations that matter are the ordinary ones around patient confidentiality: send only to the patient's own confirmed number, restrict who in the lab can send, and keep the authoritative record in your own system rather than in chats. If you operate under a specific regulator or an institutional contract, check its rules on electronic disclosure.
Is WhatsApp secure enough for medical reports? Messages are encrypted in transit, so the realistic risks are on either end rather than in the middle: sending to the wrong recipient, a shared family phone, or reports accumulating on a staff member's personal device. Those are the ones your procedure has to address.
Should we use WhatsApp Business or a normal account? Business, on a number owned by the lab. It gives you a profile with your lab's details, greeting and away messages, quick replies, and — most importantly — continuity when staff change.
What if a patient asks us to send their report to someone else? Take that instruction from the patient, not from the other person. For anything sensitive, confirming directly with the patient first is the defensible course.
Should we stop printing reports? No. Plenty of patients still want paper, and some need it for employers or visa processes. The printed copy and the PDF are the same document; offer both.
Can patients get a report they lost? Yes, in seconds, because the master copy is in their record rather than in a chat. This is one of the more visible day-to-day benefits of keeping the system as the source of truth.