Behavioral health
The front desk sees the schedule, not the session
The front desk role reads appointments and demographics with Notes left unchecked, so therapy notes never reach their screens. The server refuses the read, not just the menu.
Security & Audit· Platform
Ultradoc records who opened every chart, what they changed, and what it said before. Each person sees only what their role allows.
See who opened a chart, and what they changed?Ultradoc does that.
Audit Log
Who changed what, when, and from what to what
Showing 55 entries
New activity takes about 5 minutes to appear here. Refresh for the latest.
Aisha, a nurse at Northgate Family Medicine, adds a recheck to Daniel Cho's visit note. This is everything Ultradoc writes down about that one change.
Cho, Daniel
Office visit · Oct 13Northgate Main
Point at a line to see what it records.
Northgate Family Medicine
Audit record of this edit · Oct 13, 2026
Access check
Who: Aisha Rahman
Role: Nurse
Sign-in: Two-step, passed
Notes: Read and write, passed
Location: Northgate Main, passed
Note lock: Open at this step, passed
Result: Allowed
One save
Note: Saved 2:18:44 PM
Audit entry: Written 2:18:44 PM
One without the other: Never
The entry
Updated note: Cho, Daniel
By: Aisha Rahman
content
Before: BP 152/94, left arm, seated.
After: BP 152/94, left arm, seated. Recheck 138/86 after 5 min rest.
+ isEdited: true
+ updatedAt: 2026-10-13T18:18:44Z
Archive
Archived: 2:23 PM
Held until: Oct 13, 2032
Before and after: Kept
Edit or delete: Not possible
Any attempt: Raises an alarm
Sealed
for six years
Later, in the log
Patient: Cho, Daniel
Views: Included
Oct 13
2:18 PMUpdated noteA. Rahman
2:02 PMAI requestK. Mensah
1:57 PMViewed patient recordK. Mensah
8:41 AMViewed patient recordL. Tran
Oct 6
11:20 AMCreated appointmentL. Tran
No need to keep this one. The archive will, for six years.
Before Daniel's encounter loads, the server checks Aisha's role and locations. Before she can edit, it checks the note lock.
The edit and its audit entry are saved in one step, so a change can never land without its entry.
The entry names who, what, when, and which chart, with the record as it stood before and after. A reviewer sees exactly which words changed.
Within about five minutes the entry reaches a write-once archive, held for six years. Nothing in Ultradoc can edit or delete it, and any attempt on the archive raises an alarm.
When a question comes later, filter the log to Daniel's chart with views included. Every open, edit, and AI request comes back in order.
A role sets what its people can read, write, and delete in each part of Ultradoc, and which locations and task categories they reach. The server checks it on every request.
Front desk
Update the role configuration.
Permissions
Route controls sidebar visibility. Read, Write, and Delete control data access independently of the route.
Encounter overrides
Edit locked encounters
Bypass the workflow-stage note lock on encounters whose current step has Block Notes enabled.
Choose how strong a second step your team needs. Raising the level never locks anyone out; people upgrade at their next sign-in.
Sign-in security
What everyone at Harbor Women's Health needs to sign in.
Raising the level never locks anyone out
People using a weaker method keep signing in and are asked to upgrade the next time they sign in.
Allow text-message codes
People who verify a phone number can get their sign-in codes by text. When off, codes go to email.
Allow remembered devices
People can skip the second step for 30 days on a device they choose to remember.
Required by your organization
Set up two-step verification
Harbor Women's Health requires two-step verification to sign in. Set it up to continue.
Passkeys can always be used to sign in, at every level.
A remembered device skips the second step for 30 days.
Inside Ultradoc, the whole chart. On a lock screen or in an inbox, only that something is waiting. Here is exactly what each channel carries.
To Nadia Haddad, parent of Sami Haddad
Sami's strep test came back negative. He can go back to school once he's been fever-free for 24 hours.
Dr. Elena Ruiz · 4:12 PM
Mon 9:02 AM
Cedar Pediatrics: Reminder: a family member's visit is Thu, Oct 16, 3:40 PM. Sent by Ultradoc. Reply STOP to opt out.
Today 4:12 PM
Cedar Pediatrics: Your care team sent you a message in Ultradoc: ultradoc.net/app
A text says what kind of thing is waiting, never what it says. Visit reminders carry the time and, when the phone serves more than one chart, a first name, withheld for adolescents.
Every service that handles patient data does so under a business associate agreement. Email and push notifications carry none, by design.
The AI in Ultradoc is held to the same record as everyone else on your team.
Every AI request is logged with who asked, which patient it concerned, and which part of Ultradoc made it.
Conversations are records, kept and filterable in the audit log like any chart.
Anything Orpheus changes is audited the same way as any edit, with the before and after.
Health information never trains models, and isn't used to build anything beyond the service your practice engaged us for.
Outside text stays quoted. Words from faxes, forms, and callers reach the AI fenced off as quoted text, with the rule to weigh them, never obey them.
Summarize his last three visits and the PSA trend.
Three visits since March. PSA went from 4.1 to 3.6 to 3.2 on finasteride, with nocturia down to once a night.
Encryption, sessions, and the details that keep patient data where it belongs.
Every connection uses TLS 1.2 or higher, and stored data is encrypted with AES-256. A text message is the one channel that can't be, which is why texts carry no clinical detail.
The EHR and billing connections your practice sets up get their own layer of encryption, bound to your practice and their purpose, so a copied secret opens nothing.
Everyone can list their signed-in devices, revoke one, or sign out everywhere. Web sessions end after an hour idle, and a practice can cap staff sessions in days.
Sign-in attempts, verification codes, password resets, and patient identity checks are all rate limited, per account and per phone number.
A strict content security policy, HTTPS enforced everywhere, no framing by other sites, and the app's own code is served only after sign-in.
If Ultradoc support ever enters your workspace, your audit log names who and when, in an entry of its own.
When a parent opens a child's record in the patient app, the entry records the person who looked and the patient they acted for.
Both apps keep cached records in the phone's encrypted storage and cover the screen in the app switcher. With app lock on, they ask for a face, fingerprint, or passcode after 30 seconds away.
Writes from your EHR sync are logged as the system and tagged with their run, so one pass can be reviewed whole, record by record.
Every module writes to the same trail, and the same role rules decide what each screen can show.
The same controls, set to the way each kind of practice works.
Behavioral health
The front desk role reads appointments and demographics with Notes left unchecked, so therapy notes never reach their screens. The server refuses the read, not just the menu.
Pediatrics
Visit reminders to a family phone say “a family member's visit” for adolescent patients, and no text ever says why the visit is happening.
Orthopedics
Staff scoped to the Eastside clinic never see main-campus encounters on their boards, and a direct link to one is refused with an access notice.
Oncology
Once an encounter reaches a step with notes blocked, only roles granted “Edit locked encounters” can change them, and every change lands in the log with its before and after.
Family medicine
The practice manager filters the audit log to one chart with views included. Every open, edit, and AI request comes back in order, each a click from its details.
Hospitalist groups
Hospitalists round from the provider app. With app lock on, it asks for a face or fingerprint after 30 seconds away, and the app switcher shows a cover instead of the census.
Our compliance statement lays out every safeguard in full. Questions go to the people who wrote it.
Every part of Ultradoc reads from the same live record, so each one makes the others better.
Tell us how your practice runs. We'll set Ultradoc up around it and connect it to the EHR you already use.