Skip to content
Elite Mind EHR
ProductSecurityPricing

Product

What it does, in the order you meet it.

Grouped the way the day is, rather than the way a feature matrix is. Every sentence below describes something a practice can use today.

The chart

Intake, scales, the note, the plan, and the path a positive screener takes.

  • A structured psychiatric intake form is assigned automatically when a new patient books their first visit, and the provider reviews it in the chart before the session.
  • Intake answers are stored centrally in the encrypted clinical record, not in the patient app.
  • Follow-up and medication-management visits are documented as SOAP notes with ICD-10 diagnosis search and a medication list carried forward from the previous session.
  • A session cannot be marked complete until all four SOAP sections and at least one diagnosis are recorded.
  • Signed notes are immutable; corrections are made as linked addenda so the original record is never overwritten.
  • Clinical records are append-only at the database level.
  • Treatment plans are versioned: each update supersedes the prior version and the history is retained.
  • Standard rating scales (including PHQ-9, GAD-7, C-SSRS, MDQ, ADHD-RS, SCARED, AUDIT, and PCL-5) are scored deterministically on the server with published severity bands.
  • Severity and suicidal-ideation flags are always computed server-side, never by the client and never by AI.
  • Providers assign standardized assessments and intake or follow-up forms to a patient from the session screen, with results returned to the chart.
  • Custom form authoring tools exist but are not enabled by default.
  • Providers author a six-section Stanley-Brown safety plan that the patient can view in the app, with crisis numbers always visible.
  • Safety plan content is encrypted at rest.
  • A positive suicidal-ideation item on any screener creates a crisis event and a persistent alert banner in the provider's EHR within seconds, with no AI in the safety path.
  • Crisis alerts must be acknowledged by a provider; acknowledgement is audited.
  • With the provider's own AI key and documented consent, the EHR can draft a SOAP note from the session transcript; the clinician reviews, edits, and accepts every note before it is saved.
  • AI can pre-fill intake and follow-up forms from the conversation; every field stays editable and is submitted only by the clinician.
  • Raw audio is never stored; only transcribed text is kept. Patients are never shown AI-generated content.
  • The chart tracks medication history, allergies, and vitals, with medications carried forward for review at each visit.
  • Prescription records can capture controlled-substance schedule; transmission to a pharmacy is not part of the product.
  • Each patient's rating-scale history renders as a trend chart with severity bands, and any result can be downloaded as a PDF.
  • Practice analytics include PHQ-9 trend over time and diagnosis frequency.
  • Patients can log daily PMDD symptoms in the app, and the platform computes C-PASS cycle patterns for the provider.

Visits

Scheduling, joining, reminders and the cancellations that follow.

  • Telehealth visits run on Zoom; the meeting is created automatically when the session is scheduled, with a waiting room enabled, and the patient receives a join link.
  • Zoom credentials are stored encrypted on the server and never exposed to the browser or the patient app.
  • Patients receive appointment reminders by push notification and by email.
  • Patients can cancel with 24 hours' notice in the app; providers can confirm, decline, or reschedule from their queue.

The patient side

What the person on the other side of the visit sees and does.

  • Patients use a native iOS and Android app or the web app; nothing clinical is cached on the device and sessions lock after 15 minutes of inactivity.
  • Face ID / Touch ID can be used as a second step to sign in.
  • Patients book online and are matched only with providers licensed in their state; the check is enforced on the server, not just in the app.
  • New patients complete an intake visit before booking regular follow-ups.
  • Patients upload ID and insurance cards from the app; files are stored encrypted and every access is audited.
  • Push notifications never contain clinical content; they only prompt the patient to open the app.

Architecture

How the record is separated, encrypted, authenticated and audited.

  • All clinical PHI is held in a dedicated, encrypted clinical data service; the patient app and booking system store no clinical data.
  • Booking, identity, and scheduling are separated from the clinical record by design.
  • Every clinic's data is isolated by tenant ID and enforced by PostgreSQL row-level security as a second line of defense, verified fail-closed.
  • PHI fields are encrypted at the application layer with versioned keys on top of encrypted storage, and all traffic is TLS.
  • AI features run only on the provider's own API key, stored encrypted; the platform holds no AI keys and no clinical data is sent to an AI vendor without the provider's key and consent.
  • Authenticator-app MFA with backup codes is available for provider accounts.
  • Every write and every patient-record read is logged to a hash-chained, append-only audit trail that is verified daily and never purged.
  • Sessions use asymmetric-signed tokens, 15-minute access windows, and single-use refresh tokens that are revoked as a family if replayed.
  • Provider passwords are bcrypt-hashed with lockout after repeated failures.
  • All traffic passes through a CDN edge with a managed web application firewall, injection and bad-input rules, IP-reputation blocking, and rate limits on login endpoints.
  • Application servers sit on private networks behind the edge.
  • Production is monitored with health and security alarms that page the operator, and deploys fail closed if code and database schema disagree.
  • Error telemetry is scrubbed of PHI before it leaves the service.
  • Third-party webhooks are signature-verified before any processing, and secrets are held in a managed secrets store rather than in code.

Posture

What is documented, and what a release is not allowed to do.

  • Elite Mind EHR is built on a HIPAA-oriented architecture: minimum-necessary data handling, encrypted PHI, tamper-evident audit logs, and documented breach-response and disaster-recovery procedures.
  • The platform undergoes independent adversarial security reviews before safety-critical changes ship, with findings tracked to closure.
  • An external penetration test is planned before scaling.

Money

Fee schedules, dashboards, payouts and subscription behaviour.

  • Administrators manage a per-state fee schedule and view a financial dashboard with revenue and payout summaries.
  • Each clinic is designed to receive its own payouts through its own connected Stripe account.
  • If a clinic's subscription lapses, providers keep read access to every patient record; only new writes are blocked.

Licensure

State licences, expiry tracking and how they gate booking.

  • Providers carry one or more state licenses, and patients are only matched with a provider licensed in their state.
  • License expirations are tracked with 30-, 7-, and 1-day warning thresholds.

Moving in

Provisioning a practice, adding prescribers, and bringing records across.

  • Clinic administrators onboard providers in one step: credentials, state licenses, NPI, availability, and clinic membership.
  • Patients register themselves in minutes with email verification; their clinical identity is created in the encrypted record at signup.
  • New clinics are provisioned as isolated tenants with their own providers, features, and subscription.
  • A guided migration tool imports records from supported exports of an existing EHR.
  • Clinics configure business hours, appointment types, provider availability, and cancellation policy.

Connections

The systems the platform works with today.

  • Elite Mind EHR integrates with Zoom for visits, Stripe for payments, and transactional email and push for notifications.
  • A clinic's marketing site can hand patients into booking with campaign attribution and without passing any health information.

Support

Who answers, and where the patient finds help.

  • The patient app includes a Support tab with one-tap 988 call and text, 911, and a way to contact the clinic.

Questions we are asked first

And the four we are always asked

Worth knowing before a demo rather than after one.

Do you do e-prescribing?
E-prescribing is on the roadmap; today the EHR produces a formatted prescription text the provider can copy for a phone-in order.
Can I bring my records from my current EHR?
A guided migration tool imports records from supported exports of an existing EHR.
How is telehealth delivered?
Telehealth visits run on Zoom; the meeting is created automatically when the session is scheduled, with a waiting room enabled, and the patient receives a join link.
Who do I talk to?
The founder. Demos are run by the clinician who built the product.

The next step

See it run a real visit.

A 30-minute demo, led by the founder, on the workflow you actually use.

Request a demo