Patient portal, as the front-end of a huge amount of electronic medical records, is essential for ensuring the security and privacy of those medical records. However, development and deployment of patient portal is non-trivial, which may suffer from both common security issues of web-based applications and specific challenges regarding complex and dynamic policies in clinical environment. In this position paper, we select an open source EMR application OpenEMR and study its vulnerabilities. We propose a two-tier defense architecture for protecting web patient portal, which consists of three major components: BLOCK, SENTINEL and ORACLE. In particular, we abstract security policies specification and enforcement out of the implementation of patient portal, which allows for independent verification and configuration of security policies and checking, as well as transparent integration of new mechanisms.