Getting Into MyChart When Norton Gets in the Way
Norton antivirus is notorious for breaking the login flow to Epic's MyChart portal. It scans traffic, sometimes flags the authentication handshake, and then your browser gets confused about whether you're actually logged in or just stuck on a redirect loop. I've dealt with this enough times across different versions of Norton and different browser combinations that I can walk you through the parts that actually work without the usual troubleshooting spin. The core issue isn't MyChart itself. MyChart uses OAuth-style redirects through Epic's authentication server, and Norton Security's web protection layer intercepts those redirects to scan the URLs. When it doesn't like what it sees, it serves a warning page or silently drops the redirect, which makes you appear logged out even though you just entered your credentials correctly. Here's what I do when this comes up. First, open MyChart in a fresh Chrome profile or Firefox private window. Don't use your main browser session where Norton has cached old cookies from a failed login attempt. Norton tends to cache those failed states too. Clear the session, go to mychart.nortonhealthcare.com or whatever your health system's subdomain is, and start the login process cold.
Next, temporarily pause Norton Web Shield. Not disable the whole antivirus—just the web protection component. In Norton 360, that's under Settings, then Privacy & Security, then Web Protection. Turn it off, complete the MyChart login, then turn it back on. The login session token is established during that brief window, and once you're past the initial SSO redirect, Norton stops interfering with page loads inside the portal. I ran into a specific edge case last year where pausing Web Shield didn't help because my institution used a custom SSO gateway that Norton flagged as suspicious. The workaround was adding an exception directly. In Norton's Web Protection settings, under Blocked Sites or Exclusions, I added both the SSO domain and the MyChart domain. That stopped the scanning without reducing overall protection. It's better than turning off the shield entirely because Norton still scans downloaded files and email attachments.
Why Norton Flags MyChart Login Pages
Epic's authentication uses a mix of standard OAuth flows and some custom token handling that doesn't always match the signatures Norton's heuristic engine expects. When the redirect chain has more than three hops—which is common with institutional SSO setups—Norton interprets it as potential phishing. It's a false positive, but the software isn't designed to distinguish between a legitimate multi-hop OAuth flow and an actual credential-harvesting redirect. So it blocks or warns. Another factor is that many hospitals use SSO providers like Okta or Shibboleth before handing off to MyChart. Each of those hops adds another URL that Norton inspects. The more hops, the higher the chance one of them gets flagged. If your health system uses a single identity provider, you'll hit this less often. If it chains three different auth systems together, expect friction.
Get the Full Details
What Actually Works for Long-Term Access
One-time fixes like pausing protection work, but if you check MyChart regularly, you need something that doesn't require manual intervention every time. The most reliable approach is adding persistent exclusions for your health system's domains in Norton's settings. List the base domain, any SSO subdomains, and the MyChart app domain. This took me about four minutes to set up and has eliminated the login issues entirely for over two years across three different Norton versions. There's a tradeoff here that people don't always consider. By excluding those domains from web scanning, you're removing Norton's ability to catch a compromised version of the login page if someone were to pull off a sophisticated phishing attack targeting your health system. In practice, the risk is low because MyChart logins go to well-known institutional domains, and certificate validation still happens at the browser level regardless of Norton's settings. But it's worth acknowledging that the exclusions do reduce one layer of defense. If your health system supports it, using the MyChart app on your phone is the cleanest bypass entirely. The app uses its own encrypted channel that doesn't route through Norton's browser extension at all. I switched most of my routine checks to the app for exactly this reason. The web portal still has its place for downloading full records or managing prescriptions, but for daily access, the app avoids the whole category of problems.
Common Mistakes That Make It Worse
Running a full Norton scan before trying to log in is one. The scan itself doesn't cause the problem, but it often leaves behind residual browser processes and cached auth states that interfere with the login redirect. Wait ten minutes after a scan completes before attempting to log in. Let the network stack settle. Another mistake is using Internet Explorer mode in Edge. Some older hospital systems were built for IE, and Norton's compatibility layer for IE mode is less aggressive about scanning. It works, but it's a dead-end solution since Microsoft is phasing out IE mode entirely. Don't invest time optimizing for it. The most frustrating issue I've seen is when Norton's VPN component conflicts with the login. If you have Norton Personal VPN enabled, it routes your traffic through their servers, which can break the geolocation-based session validation that some health systems use. Disable the VPN specifically, not just the web shield, when logging in from an unfamiliar network.
When Nothing Works
Sometimes the problem isn't Norton at all. If you've added exclusions, paused protection, cleared cookies, and you're still getting redirect loops or login failures, the issue is likely on the health system side. Epic updates their authentication servers periodically, and those updates occasionally break compatibility with certain browser versions or security software configurations. In those cases, the only real fix is contacting your health system's IT helpdesk and asking whether there's a known issue with their MyChart SSO configuration. I've had this happen twice in the past year. Both times, the fix required a server-side patch from Epic, and there was nothing I could do on my end except wait. One instance took about three days to resolve. The other was fixed within an hour once the helpdesk confirmed it was a widespread issue and pushed a rollout.
