Mass General Brigham Partners Gateway: Secure Remote Access And System Portal Guide For 2026

Disambiguation Note: The platform historically known as the Partners HealthCare Applications Gateway has been modernized and transitioned under the unified Mass General Brigham (MGB) digital infrastructure. This guide covers remote access protocols, security standards, and troubleshooting for the current 2026 MGB Workspace and Legacy Partners Gateway portals.

Secure, uninterrupted access to clinical systems, patient databases, and administrative resources is a critical requirement for healthcare professionals. The Mass General Brigham Partners Gateway serves as the centralized identity provider and application portal for thousands of clinicians, researchers, and affiliated partners across Massachusetts General Hospital, Brigham and Women's Hospital, Newton-Wellesley Hospital, and associated community practices.

Operating within a highly regulated healthcare ecosystem in 2026 requires strict adherence to security protocols, credential management, and remote access systems. This technical manual provides an authoritative resource for navigating the login architecture, utilizing multi-factor authentication (MFA), troubleshooting connectivity disruptions, and maintaining compliance with contemporary health IT security standards.

Navigating the Evolution of Partners Gateway to MGB Workspace in 2026

The organizational rebranding of Partners HealthCare to Mass General Brigham has successfully consolidated the enterprise's digital footprint. While legacy web domains and redirects continue to support backward compatibility for integrated systems, the underlying infrastructure has transitioned to a modern, zero-trust network access (ZTNA) framework.

At its core, the portal functions as an application delivery controller (ADC) driven by Citrix StoreFront and NetScaler technology. This architecture allows thin-client delivery of heavy clinical applications directly onto external machines without storing protected health information (PHI) locally.

The primary workloads delivered through the portal include:

• Epic Systems (Partners eCare / MGB eCare): The unified electronic health record (EHR) platform utilized across all acute care and ambulatory clinics.
• PeopleSoft (HR & Finance): The administrative core for employee benefits, payroll, time tracking, and supply chain management.
• Clinical Imaging Applications: Web-enabled Picture Archiving and Communication Systems (PACS) for diagnostic radiology and cardiology reviews.
• Microsoft 365 Enterprise Suite: Secure, HIPAA-compliant cloud storage, email hosting, and collaborative communication environments.

Authorized Access Methods and Technical Specifications

To maintain the integrity of the clinical network, access tiers are segmented based on the user's relationship with Mass General Brigham. Remote workstations must meet specific hardware and software baseline requirements before establishing a secure handshake with the gateway.

System and Device Prerequisites

Accessing clinical applications through the web gateway requires the client device to run verified software configurations. In 2026, the minimum operating system versions and browsers supported include:

• Operating Systems: Windows 11 (Enterprise or Professional, Version 23H2 or newer) or macOS 14 (Sonoma) and macOS 15 (Sequoia). Linux systems require Red Hat Enterprise Linux 9 or Ubuntu 24.04 LTS with updated Citrix Workspace packages.
• Local Client Software: Citrix Workspace App (Version 2402 or higher is highly recommended for optimal rendering of Epic Hyperspace elements).
• Web Browsers: Google Chrome (v120+), Microsoft Edge (v120+), or Apple Safari (v17+). Cookies and JavaScript must be globally enabled.
• Identity Token: An active MGB Key (formerly Partners Key) paired with an enrolled Duo Security multi-factor authentication profile.

Comparative Breakdown of Partners Gateway Remote Access Modalities

Depending on your operational role—whether an internal attending physician, an external referring specialist, or a research associate—the appropriate access path differs significantly. The following table highlights the primary configurations available through the portal.

Step-by-Step Security Enrollment and Portal Login Protocol

New users or those deploying a fresh workstation must complete a standardized sequence to establish a trusted handshake with the MGB servers.

Step 1: Initializing the Duo Multi-Factor Authentication Profile

Before attempting to log in from an external network, you must register a secondary authentication device.

1. Access the self-service portal from an internal, hardwired MGB network device or complete remote onboarding using the secure link provided by your department administrator.
2. Select Enroll Duo Security and enter your unique MGB Key and temporary PIN.
3. Register your primary mobile device by scanning the generated QR code with the Duo Mobile application.
4. Set up back-up verification methods, such as an alternative phone number or a hardware security key, to prevent lockout scenarios.

Step 2: Accessing the Gateway Interface

1. Launch an approved web browser and navigate to the official portal page.
2. The page will present a unified single sign-on (SSO) login card. Enter your MGB Key (username) and password.
3. Click Sign In. The gateway will automatically trigger the Duo Security Universal Prompt.
4. Approve the push notification on your mobile device, or input the secure security key passcode.

Step 3: Launching Applications via Citrix Workspace

1. Upon successful verification, the browser redirects to the Citrix StoreFront homepage.
2. If prompted to "Detect Citrix Workspace App," confirm the detection or opt to run the applications within the HTML5 web-wrapper (note: the native application offers superior performance for clinical charting).
3. Select the Favorites or Apps tab to view your assigned applications.
4. Click once on the Epic eCare or MGB Desktop icon. The browser will download a secure launch file (.ica), which automatically executes via the Citrix Workspace App to establish a secure, encrypted virtual channel.

Troubleshooting Common Gateway Failures and Connection Interruptions

When accessing critical health systems remotely, performance issues or authentication failures can impact clinical delivery. Use the following structured resolutions to address the most frequent technical roadblocks.

Citrix App Launch Failures

If clicking an application icon results in an downloaded .ica file that does not open, the system association is broken. To resolve this, uninstall legacy Citrix Receiver tools and install the 2026 edition of Citrix Workspace App. If the issue persists, clear your browser's cached files and cookies, restart the browser, and attempt the launch again to force the browser to re-detect the local Citrix client.

Duo MFA Push Notification Latency

When a login attempt hangs on the multi-factor authentication screen, the fault usually lies with local mobile network latency or an out-of-sync app clock. Open the Duo Mobile app manually and pull down on the screen to force a refresh. If no request appears, choose the "Enter a Passcode" option on the gateway browser, generate a manual passcode within your offline Duo app, and input it into the login field.

Resolving Account Lockouts

If you exceed five consecutive incorrect password attempts, your MGB Key will automatically lock for security purposes.

1. Navigate to the self-service password management page linked on the portal sign-in page.
2. Select Unlock Account / Reset Password.
3. Verify your identity by answering your pre-configured security questions and completing a Duo MFA verification challenge.
4. Once verified, the system will release the lock. If you are unable to self-authenticate, contact the unified MGB IS Service Desk at the dedicated clinical support number (617-726-5085).

Operational Guidelines and HIPAA Compliance Standards for Remote Clinical Work

The convenience of remote portal access brings substantial responsibility under the Health Insurance Portability and Accountability Act (HIPAA). System activity within the Partners Gateway and Epic eCare is continuously logged, audited, and monitored by the Information Security and Privacy Office.

To remain compliant while accessing patient records off-site:

• Prevent Shoulder Surfing: Ensure your physical monitor is positioned so that unauthorized family members, patients, or bystanders in public spaces cannot view clinical screens. Utilize polarized privacy filters on laptops used outside clinical units.
• Disable Auto-Save Credentials: Under no circumstances should passwords, MGB Keys, or session cookies be saved within personal web browsers or password managers not approved by the MGB IS department.
• Enforce Automatic Session Timeout: If you step away from your home computer or laptop, lock the workstation immediately. The gateway enforces an automated idle-session disconnect policy after 20 minutes of inactivity; however, manual locking remains the primary line of defense.
• Zero Local Storage: Never download clinical reports, patient registries, PDF clinical notes, or medical imaging files to personal hard drives. Keep all active workflows strictly confined to the virtualized Citrix container.

Frequently Asked Questions Regarding Partners Gateway Access

How do I log in if I have forgotten my MGB Key or password?

You can retrieve a forgotten username or reset a expired password by visiting the self-service identity manager on the gateway homepage. You must verify your identity using your pre-enrolled Duo Mobile authentication and answering personal verification questions. If you have not set up self-service recovery, you must contact the IT Service Desk directly with your employee ID number on hand.

Why does my Citrix session disconnect repeatedly while writing clinical notes?

Repeated session drops are typically caused by local network packet loss or aggressive local firewall rules. Ensure that your home router allows outbound UDP ports 1494 and 2598 (used by Citrix Session Reliability protocol). If utilizing a public Wi-Fi network, connect to a secure cellular hotspot or enable the web-only HTML5 receiver option through the portal settings to reduce connection drop-outs.

Can I access the Partners Gateway from my iPad or Android tablet?

Yes, you can access the gateway on mobile devices. You must install the free Citrix Workspace App from the Apple App Store or Google Play Store. Once installed, navigate to the secure portal web address in your mobile browser, authenticate through the Duo MFA screen, and the browser will pass the virtual session token to your mobile Citrix application to launch Epic Canto or the full virtual clinical desktop.

What should I do if my Duo Security mobile device is lost or broken?

If you lose your registered mobile device, you cannot pass the gateway login portal independently. You must contact the MGB Help Desk to verify your clinical identity and receive a temporary bypass code. This code is valid for a restricted period, during which you must log into the Duo self-service console to register your new replacement device.

Does the gateway support native printing to my home printer?

Limited printing support is available depending on your security clearance and department profile. If printing is authorized, the Citrix session will utilize the Citrix Universal Print Driver to map your local default printer inside the virtual application. Make sure your local printer is active and connected to your computer before launching your virtual gateway session.

Elevating Clinical Workflow Efficiency with Secure Portal Management

Mastering the mechanics of the secure Partners Gateway is essential for optimizing administrative time, reducing cognitive load, and enhancing patient care continuity in 2026. By ensuring your personal devices are kept up-to-date with the latest Citrix integrations, establishing robust multi-factor backups, and operating strictly within the bounds of HIPAA-compliant data stewardship, you can transition seamlessly between hospital networks and secure remote workspaces. For any technical challenges that arise outside standard self-service paths, the Mass General Brigham Information Systems teams remain available around the clock to support clinical operations.