Oakland University: cloud EHR for a counselling training clinic

• Prepared for: Oakland University, School of Education and Human Services, Department of Counseling
• Attention: George Haight, Buyer, Oakland University Purchasing Department
• Prepared by: Carepatron, Verify who is the named preparer and title on this response, Glen or Carlos?
• Date: 3 November 2026

Executive summary

Carepatron is pleased to respond to Oakland University's Request for Information for a clinical cloud-based EHR and video recording system. We have read the RFI with the SEHS Counseling Center's purpose in mind. It is a teaching and research facility where graduate students apply counselling theory in practice while providing supervised, no-cost counselling to people in need.

Carepatron is a cloud-based, all-in-one EMR and practice management platform founded in 2021, serving more than 100,000 health and wellness professionals across a range of specialties worldwide. Scheduling, clinical documentation, telehealth, secure messaging, a client-facing portal, reporting and AI-assisted note-taking all live in one system with one login. We do not bundle separately licensed modules together. Capabilities that other platforms charge for separately, including AI documentation, are included at the practice level.

Four things are worth calling out up front for the Counseling Center's context.

We do not record video sessions, and that is half of what you asked for. We are leading with this rather than burying it. Carepatron does not record or store video sessions in any form, native or through a partner. If recording is non-negotiable and must come from one system, we are not your vendor, and we would rather you know that on page one. If you would accept the EHR and the recording tool as two systems, which your own question about third-party video relationships suggests you might, then the rest of this response is worth your time.

Your browser access problem is the problem we solve. You describe an on-premises dual system where the components that are not cloud-hosted need a resource-intensive process for secure access to campus computers and servers. Carepatron is fully cloud-based and runs in any modern browser on any device, with no VPN, no campus machine and no local install. For a clinic running a split in-person and telehealth model, that removes the access layer entirely.

Your student count costs you nothing, and your rotating cohorts are handled. Licensing is per staff user only, and client records are unlimited at no per-client charge. Seats prorate automatically as people are added or removed, and removing a team member issues a credit for the unused part of that seat against future invoices. For a clinic that turns over a student cohort three times a year, that is the difference between paying for the year and paying for the semester.

AI documentation is included for every user, not priced per clinician. The AI Scribe sits on every paid plan with no per-seat add-on fee. Your faculty set the note template and output format once for the department, and students work inside that standard without configuring anything themselves. For a training clinic, standardising how 40 or more trainees document a session is a teaching outcome as much as an administrative one.

We answer to what Carepatron does today. Where something is not supported yet, such as video recording, live observation and supervisor approval routing, we say so plainly rather than selling a roadmap. Where those gaps are requirements, we are glad to discuss whether we can close them collaboratively.

Section III, information requested

Your Section III lists what the system needs to be capable of. We have answered each line in your order, including the lines where the answer is no.

Your questions for vendors

Architecture and security

How and where do you store client data and video? Client data is hosted on Amazon Web Services, with DDoS protection, data loss prevention, backups, status monitoring and continuous monitoring in place. Our published sub-processor list names AWS (hosting, US, Australia and Europe), Google Cloud (hosting, US and Singapore), Stripe (payments), Claim.MD (claims clearinghouse) and Intercom (customer support). Sub-processors must encrypt data at rest and in transit, restrict access to authorised personnel and maintain incident response plans. Hosting regions align with applicable local requirements, but we cannot commit to a customer-selectable data region. No video is stored, because none is recorded.

Do you incorporate AI features? In what manner and for what purpose? Yes, and the detail matters for a training clinic. The AI Scribe transcribes a session as it happens and drafts a structured note into the template in use. The clinician reviews and approves every note before it is finalised; the AI produces a draft, never a final record. A pre-appointment summary gives the clinician a briefing drawn from the client's previous documentation. An AI consent template is available in our library and can be included in your standard intake packet, so clients consent to AI-assisted documentation before their first session. On data handling: our BAA covers PHI across our services including AI note generation and transcription, and our enterprise agreements with cloud infrastructure providers prohibit customer data being used for model training. If your IT review needs the specific model or inference sub-processor named, we will route that through our formal compliance package rather than answer it here.

What are your backup schedules, retention periods and recovery timelines? Backups, status monitoring and continuous monitoring are part of our controls and are listed in our Trust Center. Verify we do not publish backup frequency, retention, geographic redundancy, restore testing, RTO or RPO. Glen, is there anything we can state here, or does this route to the compliance team as a contract term? This is a scored question for a university IT review and answering it with silence is costly.

What cloud providers or platforms do you use? Amazon Web Services is our hosting provider. Our sub-processor list also names Google Cloud. Detailed architecture documentation is available through our Trust Center at trust.carepatron.com.

Platform requirements and support

Are there end-user hardware or software requirements? Nothing beyond a current browser. For telehealth we recommend a computer from the last three to five years with a 2.5GHz processor and 4GB RAM, and at least 0.35 Mbps of bandwidth, with 10 Mbps or more preferred. A clinic running several simultaneous clinician calls should have 35 Mbps or more. These are recommendations, not licensed requirements.

Does your solution support cross-platform, multi-device use? Yes. Full-featured iOS and Android apps give clinicians their schedule, notes, billing, messaging and the AI Scribe for in-person sessions. Carepatron also installs as a desktop app on Windows and macOS, and the web application is fully responsive. The client portal is mobile-responsive and needs no app download. One note of precision: our App Store listing is US-only, and users outside the US install by adding the mobile web app to the home screen.

How many institutional administrators or account managers are included? Administrator is a permission level rather than a separately licensed seat, so any number of your staff users can hold administrative rights at no extra cost. Granular role-based permissions sit on the Advanced plan. On the relationship side, the Advanced plan includes one named account manager for the department.

What end-user support model is provided, and is it 24x7? Support runs 24/7 through in-app chat and our help centre, with a named account manager on the Advanced plan. An in-app Help button opens Ava, our AI assistant, which answers directly and escalates to a human support team member on request. For general questions the fastest route is the 24/7 support infrastructure rather than the account manager. We do not publish resolution-time SLAs today, and we would rather tell you that now than point at a number we do not commit to.

Video and recording capabilities

This is the section where we fall short of what you asked for, so we have answered it directly rather than reframing the questions.

Is your video solution natively built into the EHR/EMR, or is it a third-party relationship? Video calling is native. HIPAA-compliant video is built into the platform and is not a separately licensed module. Sessions launch from inside the appointment, and clients join from a single link with no software, extension or meeting ID to manage. Group calls support up to 250 participants, each joining from their own appointment confirmation or reminder link, on the Plus or Advanced plan. A waiting room is enabled automatically on every call. Recording is neither native nor available through a third party. We want that read as a flat no rather than a qualified yes about video.

Does your solution integrate with Zoom or other applications? Zoom connects as an integration from Connected Apps. Google Meet, Microsoft Teams and Doxy.me can be used as virtual locations by pasting the meeting link, which is a manual link rather than a live integration. A clinic that wants to keep its existing video platform can do so, and the AI Scribe still works on those calls through the client record. This is the practical route if you pair Carepatron with a separate recording tool: run the session on the platform that records, and keep the clinical record, transcript and note in Carepatron.

Does your solution compress video for storage or pricing purposes? Not applicable. No video is stored.

Does your video solution allow pins or annotations? Not currently supported. There is no recording to annotate, and we have no in-call whiteboard.

What is the expected latency under standard network conditions? Verify we publish bandwidth recommendations but no latency figure, and I will not invent one. Glen, is there a measured figure we can give, or does this become a "we do not publish this" answer?

Clinical and supervisory workflows

Does your solution allow routing or return for signature and approvals? Partial, and this is the second real gap. A clinician inserts a drawn signature into a note, form or template from the note toolbar to signify approval before it is shared. A completed note can be locked from the note menu, which restricts further editing. Notes are private by default, visible only to the author and team members with permission, until explicitly shared. Verify is there a formal routing workflow that sends a note to a supervisor for approval and returns it to the student, with a co-signature? Our sources document the signature itself but no co-signature or sign-off workflow. Glen, this is the single most important open question in this response after recording, because supervised trainee documentation is the buyer's core workflow.

Does your solution support multi-supervisor review, routing and approval for a single student trainee? Verify same question, extended to several supervisors over one trainee. Role-based permissions and per-client assignment let multiple faculty see a student's caseload, but we cannot claim a multi-approver routing chain from our sources.

How do faculty and supervisors review or comment on student notes? Role-based permissions control this. Documentation access can be set to none, assigned clients only, or everything, for view and edit independently, and access can be scoped further by assigning specific clients to a team member. So a supervisor sees their trainees' documentation and nobody else's. Secure in-app messaging covers internal team members as well as clients. Verify can a supervisor leave an inline comment or annotation on a student's note, as distinct from editing the note or messaging the student separately?

Do you offer online client intake forms? Yes. Digital intake and consent forms are built natively and sent automatically ahead of the first appointment, or from the client record in a few clicks. Clients complete them through a secure, mobile-friendly link with e-signature support, and completed forms file straight to the client record. A client can complete a form without signing in if you prefer. Any template can also be published as a public form, shared as a direct link or embedded on your website. Note that intake links expire 30 days after they are sent and must be reissued after that.

What does the intake process look like for a new client? Templates placed in a starred Intake folder are sent automatically to every newly created client through the onboarding workflow, and that folder holds up to nine forms or templates. Any template can also be flagged as the intake default so it attaches whenever an appointment is booked with that client. Workflow automations trigger on client and documentation events, scheduling events and communication events, so the intake send is automatic rather than a task someone remembers.

Do you have pre-built, editable intake templates, or do we build our own forms? Both, and you should not have to rebuild anything. There is a community template library of more than 9,000 templates, including standardised behavioural health instruments such as GAD-7, PHQ-9, PCL-5, DASS-21, AUDIT, EPDS, ASRS-v1.1, the ACE questionnaire and ADHD screeners. A scoring group field calculates results in real time as the form is completed, visible to practitioners while hidden from clients. Forms are built in a drag-and-drop editor with sections, reorderable questions and data chips that pre-fill from the client record. Existing PDF forms import with labelled fields mapped automatically. Our team will rebuild your existing forms and templates for you during onboarding. Two limits worth stating: only single-choice fields can feed a scoring group, and there is no conditional or branching logic in the form builder today.

Does your solution offer client reminders? Yes. Automated appointment reminders go out by email and SMS, with message content and send timing set at the practice level. Reminder templates can be translated, and a client's preferred channel, language and time zone sit on their record. Invoice, intake and portal-invite reminders run from the same framework. Two honest limits: only email reminders carry the appointment or video call link, and there is no in-product delivery log confirming a reminder was sent.

Implementation and migration

Can you import or transfer records from a previous EHR/EMR platform? Yes. Our customer success team migrates client records, documentation and appointment history from your current platform as part of onboarding. For a deployment of your size we scope this as a dedicated migration project rather than a self-service import, so each client's history arrives intact and care continues without interruption. We have documented import paths from SimplePractice, TherapyNotes, Ensora (TheraNest), Office Ally, Zanda (Power Diary), Cliniko, Session Health, TherapyAppointment, Practice Fusion, Halaxy and others, plus generic file import accepting .zip, .csv, .xlsx and .xls. Source fields auto-match to Carepatron record fields for review before import, and the flow includes a duplicate review step. Your current system is an on-premises dual solution rather than one of the named platforms, so we would scope the extraction with you at kickoff.

What level of staff involvement is required preparing for and during launch? Implementation is scoped at kickoff and led by a dedicated onboarding manager, covering workspace configuration, roles and permissions, replication of your forms and templates, staff training and go-live support. A clinic can typically be live in two to four weeks, and where training needs are greater, implementation support can spread over 30 to 90 days. That two-to-four-week figure is our experience for a single-site centre of roughly 20 staff, so treat it as indicative for your scale rather than a commitment. Training covers a 1:1 onboarding manager, live team training for clinical and administrative staff, go-live support, a self-serve help centre and a training hub with webinars and a video library. The 1:1 onboarding manager sits on the Advanced plan. We do not quantify included training hours, and we would rather scope that with you than publish a number.

A point specific to your clinic: your student cohort turns over three times a year, so the recurring training burden is onboarding each new cohort, not the one-off launch. We would build that into the implementation plan as a repeatable semester induction rather than treating it as a single event.

Vendor information requested

1. Company information

• Company name: Carepatron
• Year established: 2021
• Address: Verify registered company address to print on the response
• Primary contact: Verify named contact, title, email and phone for this submission
• Ownership type: Verify private, public or other, and the correct legal entity name
• Relevant certifications: SOC 2 Type II, confirmed through independent audit that security controls are designed effectively and operate consistently over time. SOC 2 Type 1 is also listed. HIPAA compliance with a Business Associate Agreement included on paid plans. Reports and certifications are available through our Trust Center at trust.carepatron.com.

2. Experience and qualifications

Carepatron is purpose-built for outpatient counselling and wellness workflows. Intake, scheduling, session documentation, case management, secure messaging and reporting are all native rather than bolted on. We serve more than 100,000 health and wellness professionals worldwide, across a range of specialties.

References from practices at a comparable scale and specialty will be made available once we have obtained their consent, should this proposal advance. We do not name customers without that consent.

Verify Glen, do we have a university counselling or training clinic customer who would consent to act as a reference for Oakland? This is a scored item for a higher-education buyer and a generic consent-first paragraph is weaker here than in a private-practice bid.

3. Product and service information

Carepatron is built as a single, fully integrated workspace. Scheduling, telehealth, clinical documentation, AI note-taking, billing, insurance claims, the client portal, secure messaging and reporting all live in one login and one price, with minimal optional add-ons. We are not aiming to bundle separate products together but to provide an intuitive application with functional depth and high usability. Capabilities that other platforms charge for separately, or require configuration at the individual-user level, are included at the practice level in Carepatron.

The differentiators that matter for your context are the AI Scribe included for every user rather than priced per clinician, unlimited client records at no per-client charge, native telehealth with no separate licence, and a template library carrying the standardised behavioural health instruments a training clinic already uses.

Compatibility and integration with existing systems. Named integrations today are Google Calendar and Microsoft Outlook two-way calendar sync, Gmail and Outlook email sync, Zoom, Stripe for payments, Claim.MD as the claims clearinghouse, DoseSpot for e-prescribing and Google Tag Manager for booking analytics. Three limits stated plainly:

• There is no native student information system connector today, for Banner, Jenzabar, PeopleSoft or any other SIS.
• We have no HL7 or FHIR interfaces, ADT feeds, or lab order and result interfaces.
• A public API is live with documentation, and the current release covers client endpoints (get, search, create). Appointment, documentation and billing endpoints are not in the present scope. The endpoint set is being actively expanded, and we describe the API by what it does today rather than by its roadmap.

Where no native connector exists, the public API can support a scoped custom integration built with your IT team, bounded by that client-endpoint scope. We would rather define that scope together than imply a connector exists.

Scalability and upgrade path. There is no practical platform ceiling at the scale of a 20 to 100 user group, and client records are unlimited on every plan. Growth is a pricing question rather than a capacity one. Billing is per team member per month and prorates automatically when people are added or removed.

4. Implementation and support

Covered above under "Implementation and migration". In summary: a dedicated onboarding manager, two to four weeks typical for a single-site centre of around 20 staff with support spread over 30 to 90 days where training needs are greater, 24/7 in-app support, a named account manager on the Advanced plan, and no published resolution-time SLAs.

5. Pricing and cost information

We recommend the Advanced plan for the Counseling Center, because role-based permissions and white labeling sit on that plan, and permission scoping is what lets a supervisor see their own trainees' documentation and nobody else's.

The Advanced plan includes:

• Clinical EHR and documentation
• Scheduling and the multi-provider calendar
• Integrated HIPAA-compliant telehealth, with no separate licence
• AI Scribe, with no per-seat add-on
• Client portal and secure messaging
• Billing, invoicing, payment processing and insurance claims tools
• Reporting and CSV exports
• Mobile and desktop apps
• White labeling, roles and permissions
• A dedicated account manager
• Public API access

Illustrative pricing at list price. Your RFI states the Counseling Center supports more than 50 faculty and students, so we have used 55 staff users. This is an estimate for illustration and not a quote.

Pricing shown is list pricing as at October 2026.

Your client count adds no cost. Licensing is per staff user only. Clients are unlimited at no per-client charge, so the number of community members the clinic serves does not change the price. The commercial footprint is simply your staff count.

Factors that typically affect cost, answering your question directly:

• Staff user count, which for a training clinic means faculty plus the student cohort. Your students are users, not clients, so they carry a seat each. We would rather state that plainly than let it surface at quote stage.
• Seat changes across the three semesters. Seats prorate automatically, and removing a team member issues a credit for the unused part of that seat against future invoices.
• Plan choice, where Advanced is driven by your permissions requirement.
• Billing term, where annual prepayment is lower than monthly.

Per-use fees on top of the subscription. These are indicative and most will not apply to a no-cost training clinic.

Enterprise structure. We can structure an agreement as a fixed annual rate covering up to a defined user count, with per-seat rates above that ceiling, rather than a rolling monthly per-seat model. Growth headroom sits inside the enterprise terms rather than triggering a renegotiation, and the agreement can include a true-up and true-down mechanism at agreed intervals. Seat ceiling, overage rate, term length and true-up mechanics are confirmed by our commercial team in a formal quote rather than in this response. A discounted rate beyond list price can be discussed if the University engages in further discussions with Carepatron.

On contract length: we are open to a longer-term agreement, and multi-year terms unlock improved rates. We would rather you confirm the product meets your requirements first.

6. Other information

Potential challenges or risks to consider. We would rather write this section about ourselves than have you find it in a reference check.

1. Video recording is the material risk. If the Counseling Center cannot run a separate recording tool alongside the EHR, Carepatron is the wrong choice and no commercial term fixes that.
2. Enterprise SSO is the second. A university standardised on an institutional identity provider will find email-and-password with MFA a step backwards in account management.
3. Accessibility documentation. We have no VPAT, and a public institution's procurement process often requires one before award.
4. Supervisory approval routing is unproven in our documentation. See the [VERIFY] items above. We would rather resolve those before you score this response than answer optimistically now.

Value-added services or innovations. The AI Scribe is the clearest one, and the value for a training clinic is pedagogical rather than purely administrative. Faculty set the documentation standard once, and every trainee works inside it. Combined with the scoring instruments in the template library and attendance reporting by status, the department gets a consistent record of how its students document, not just what they document.

Known gaps

Consistent with how we respond to every institution, here is a consolidated list of where Carepatron does not meet every requirement you have described. We would rather put this clearly in the response than have it surface later. It is ordered by how much it matters to you, not by product area.

• Video recording of sessions. Not currently supported. Not native, and not through a partner. There is no workaround inside Carepatron that produces a reviewable session video. The only path is a separate recording platform running alongside Carepatron, with the clinical record, transcript and note staying in Carepatron. This is a real gap for your use case.
• Video retention, transcripts of video, timestamping and admin download. All follow from the line above. The AI Scribe gives you a text transcript of every session, which is a genuine record, but it is not a recording.
• Live observation. Partial. A supervisor can join a telehealth session as a participant. Whether they can observe without appearing to the client is unconfirmed and flagged above.
• Supervisor approval routing and co-signature. Unconfirmed in our documentation. Permissions let supervisors see trainee documentation, and notes can be locked and signed, but we cannot claim a formal route-and-approve workflow today.
• Enterprise single sign-on. Not available today. No SAML, no OIDC, no SCIM provisioning. Supported sign-in is email and password with MFA, plus Google and Apple SSO. Outlook calendar and email sync are supported, which is a different thing. If Carepatron fits across the rest of your requirements, we would welcome a conversation about what delivering institutional SSO would involve and on what timeline.
• WCAG conformance and a VPAT. Not implemented, and we hold no conformance report. We are not going to offer one we do not have.
• Published SLAs, uptime commitments and recovery objectives. We do not publish resolution-time SLAs, an uptime percentage, a service-credit mechanism, or RTO and RPO figures. Support is 24/7 in practice. Where your process scores an SLA, we would treat it as a negotiable contract term rather than answering no and moving on.
• Student information system integration. No native SIS connector, for any SIS. The public API can support a scoped custom integration, bounded by client endpoints.
• HL7 and FHIR. No interfaces, no ADT feeds, no lab order or result interfaces.
• Conditional logic in intake forms. Not available in the form builder today. Forms split into sections, and separate targeted forms can be sent from the client record.
• Bulk data export is not complete. The bulk client export covers the client record's Personal tab: contact details, demographics and custom fields. Notes, appointments and inbox messages are not in the bulk export and download per client record. A full-history extraction is a support-assisted exercise rather than one click. This matters for an exit clause, so we are naming it now.
• Client portal branding. Your workspace, intake forms and communications carry your branding. The portal itself is not white-labeled and has no custom domain.
• Session timeout. No automatic idle timeout or session policy is documented. Sign-out is manual from the profile menu.
• Room and resource booking. Rooms and equipment are not bookable resources with their own availability and conflict checking. Appointments carry a location, and multiple clinicians can be scheduled on one appointment.

Schedule F, IT technical compliance

Your Schedule F asks for documentation and says that where a supplier cannot provide an item, we should include the rationale. We have done that rather than leaving blanks.

Recommended next steps

1. Submit clarifying questions through MITN by 13 October, 12:00 pm EST. Two questions decide whether this bid is worth completing: whether video recording may be delivered by a separate system alongside the EHR, and whether supervisor approval of trainee notes must be a formal in-system routing workflow. The addendum on 20 October would answer both, with two weeks still left to respond.
2. A working session with the Department of Counseling to walk through live observation and supervisory review as you actually run them, so we can answer those requirements against your workflow rather than against a generic description.
3. Confirmation of your user count across faculty, supervisors, instructors and each student cohort, so the illustrative pricing above becomes a real quote.
4. A security and accessibility review with Oakland University IT, where we would rather walk through the SOC 2 Type II report and name the VPAT and SSO gaps directly than have them surface at evaluation.

We understand this is an information-gathering exercise ahead of a possible RFP, and we are glad to be useful at this stage whether or not we are the eventual supplier. Thanks for considering Carepatron for the SEHS Counseling Center.