Auto Secure LoginYou focus on therapy, we focus on the paperwork.
ASL Therapy is a HIPAA-minded practice-management platform for independent therapists, group practices, and court-directed treatment programs. It runs the full clinical back office — clients, scheduling, clinical notes, assessments, secure messaging, invoicing, and court/SOMB reporting — under field-level encryption, a tamper-evident audit chain, and access control built so that a record is invisible unless someone is explicitly authorized to see it.
The problem
Enterprise EHRs are overkill. Spreadsheets are a breach waiting to happen.
Solo and small-group practices are stuck between six-figure EHR suites they don't need and DIY tools that quietly put protected health information at risk. Court-directed programs have it worse — they must produce defensible reports to a state board, on a system that can prove exactly who saw what, and when.
ASL Therapy is the middle path: real HIPAA-grade technical safeguards, without the enterprise weight or cost — and built to fail closed the moment authorization is uncertain.
What "fails closed" means here
- An unauthorized client record returns 404, not 403 — its very existence is withheld.
- A signed clinical note can be amended, but never edited — the signature is terminal.
- A court report can't be delivered until a second authorized human approves it.
- There are no delete routes anywhere — records are retained, not destroyed.
- PHI activation is gated at the server — the pilot runs on synthetic data by design.
Capabilities
The whole practice, in one place.
Clinical, financial, and compliance work — each safeguard doing exactly one job, and doing it verifiably.
Roles & visibility
Eleven workforce roles per practice, plus a platform-admin identity a practice can't assign. Per-client four-level visibility (practice / assigned / supervisors / org-admin).
Clinical notes
DAP / SOAP / progress notes with a draft → sign → amend lifecycle. Server-side autosave that never touches localStorage and clears on idle timeout.
Court & SOMB reporting
Reports require a second authorized approver, the author can't approve their own, approval requires opening the actual text, and the app never auto-transmits.
Standards, in-editor
Official Colorado SOMB standards are searchable right inside the report editor, served by the platform's Policy Lens engine.
Scheduling
Appointments across individuals, groups, and couples — a group session creates one appointment per member so invoicing stays per-client.
Assessments
PHQ-9 / GAD-7-compatible storage with no automated diagnosis — interpretation stays a human-review status until a clinician writes it.
Billing & vouchers
Invoicing and superbills, plus a full ledger for probation/court/county/grant funds — every credit and debit is a row, so a balance is always explainable line-by-line.
Secure messaging & portal
A client portal with published documents that snapshot the text — a later amendment can't change what a client already read — plus password-protected Secure Send.
Disclosure log
A fixed seven-reason disclosure list with a server-derived legal basis — it records a lawful disclosure but never adjudicates one.
Bilingual, role-aware help
41 reviewed help topics in English and Spanish (82 translations), filtered to each user's exact permissions.
Break-glass access
Time-limited (15–240 min) support access, practice-owner-only, with an encrypted written reason — fully audited.
CCTP rate reference
All 62 approved Colorado CCTP services and state-paid rates, sourced to the official AR form.
How the safeguards fit together
Every action is provable after the fact.
Encrypted at the field
Client names, note content, assessment answers, messages, and report narratives are AES-256-GCM encrypted — with HMAC blind indexes so records stay searchable without being readable.
Checked three ways
Every request passes three independent server-side authorization checks — tenant, role, and client-visibility — all funneled through one visibleClientIds gate.
Logged, and verifiable
Every audit row is HMAC-chained per organization and re-verifiable from genesis at /audit/integrity — the record proves its own integrity.
Who it's for
Built for the practices the big EHRs ignore.
Solo clinicians
LPCs and LCSWs who want real safeguards without an enterprise contract or an IT department.
Group practices
Multiple therapists, supervisors, billing, and admin staff — each seeing exactly what their role allows.
Court-directed programs
Colorado sex-offender treatment and probation-directed programs (CCTP) that must produce defensible, board-ready reports.
Questions
Straight answers.
Is my clients' data encrypted?
Yes — field-level AES-256-GCM covers names, contact info, note content, assessment answers, message bodies, and report narratives. Searchable fields use HMAC blind indexes so lookup works without decryption.
Can staff see records they shouldn't?
No. Three independent authorization checks run on every request, and a client outside your scope returns 404 — the record's existence is never revealed.
Can a note be secretly edited later?
No. Signing is terminal; a signed note can only be amended, with the amendment recorded. There are no delete routes anywhere in the system.
How is a court report protected from mistakes?
A second authorized human must open and approve the actual report text before delivery, the author can't approve their own, and the app never transmits automatically.
Practice management that fails closed.
Real safeguards, an auditable trail, and a system that withholds what you're not authorized to see. Bilingual, and built for the practices enterprise EHRs overlook.