For operators
The architect's view of Conceptual Health.
Whether you're standing up your first clinic, federating an MSO across many sites, or evaluating CH as a replacement for your existing EHR + RCM + analytics stack — this is the operator-grade material. Architecture diagrams. Deployment models. Integration surfaces. Governance. SLAs. The numbers your security team is going to ask for, before they ask.
Clinic owner
Independent primary care, dental, optometry, vet, or pharmacy. CH replaces your EHR, billing, scheduling, payroll, and analytics — at $0 in software cost, in exchange for joining the network.
Deployment options →MSO / health system
Federate multiple clinics under unified clinical, operational, and financial governance. Multi-tenant, multi-region, with org-level analytics and roll-up.
MSO architecture →CMIO / IT director
You need to know what we replace, what we integrate with, what we expose, and what controls your auditors will see. Architecture decks, FHIR endpoints, identity model.
Integration surface →Compliance & legal
BAA, DPA, SOC 2, HITRUST, ISO 27001/27701, HIPAA, GDPR, state breach laws. The packet your reviewers want.
Compliance posture →Deployment models
Three ways to run on us.
All three deployments use the same code, the same FHIR/OMOP surfaces, and the same trust controls. They differ in who operates the infrastructure, who holds the keys, and where data crosses your perimeter.
Hosted on CH Cloud
Default for most clinics. CH operates the full stack — Vault, Ledger, Authority. You get a tenant in our multi-region production fabric.
- Zero infrastructure on your side
- Continuous updates, no maintenance window
- Region pinning available
Dedicated CH Cloud
Single-tenant deployment of the full CH stack inside a dedicated cloud account that we operate but you can audit live. Tenant-scoped KMS key under your control.
- Single-tenant infra, multi-clinic logical
- Real-time audit via SIEM connector
- Customer-defined region + DR pairing
Self-hosted (BYOC)
You operate the entire stack inside your own cloud account. CH ships signed Helm charts + Terraform modules; we provide L3 support against your infrastructure.
- You hold all keys, all data, all logs
- Air-gap mode supported (FedRAMP, defense path)
- K8s 1.28+, Postgres 16+, your existing IdP
Time-to-live targets are published per deployment in your engagement plan. Each go-live moves through the compliance posture from Architected to Active when the per-surface BAA, security review, and customer acceptance are signed.
Architecture, top-down
Six layers. Every one of them swappable, observable, signed.
The full stack runs across six logical tiers. Tier 0 is the cryptographic root; you can verify every layer above it with a published signature. We treat the architecture as a public contract — the diagrams below are excerpts from the deck we send to your reviewers.
Patient hub (PWA), clinic stations, ops consoles, regulator portal, researcher exchange. All built on the same component kit; all three-tier-RBAC behind the same auth.
FHIR R4 (USCDI v4) for clinical, OMOP for research, GraphQL for product, gRPC for system-to-system. Every call is HMAC-signed and logged to the Ledger.
Encounter, Scribe, Pharmacy, Labs, Imaging, Scheduling, Billing, Claims, Network, Authority. ~40 services total, each independently deployable.
Continuously scores every patient on the eight axes. Daily re-score; on-demand re-score on new encounter. Reference implementation locked by 50 golden vectors across JS + Python — CI fails on drift.
Append-only, Merkle-rooted, externally witnessed. Tracks issuance, settlement, redemption of HCC. The Authority sets the HCC reference rate per its published cadence.
Encryption at rest with per-record DEK, per-tenant KEK, HSM-rooted master. k-anonymity ≥ 5 enforced before any export. Statistician-signed cohorts only.
Root key held under Shamir custody by named officers; quorum required for rotation. Recorded and witnessed by external auditor. Last rotation timestamp + signers published on the trust hub.
Integration surface
What we replace, what we integrate.
CH is not bolt-on — it is the EHR, the billing system, the scheduling system, the analytics stack, and the patient portal. Below is what we replace outright vs. what we integrate with, plus the standard interface for each.
FHIR R4 · USCDI v4X12 5010 · ANSI 837/835NCPDP SCRIPT 2017+HL7 v2 · FHIR R4DICOMweb · FHIR R4SAML 2.0 · OIDC · SCIMIHE · Direct · HL7 v2OpenTelemetry · syslogSCIM · webhook · CSVOMOP CDM v5.4Onboarding timeline
From contract signed to first encounter, in roughly 30 days.
For a single clinic on Hosted CH Cloud. MSO and self-hosted timelines scale with clinic count and your security review cadence. The four-week shape is consistent.
Contracts & security review
- BAA + DPA signature
- Diligence packet review
- Architecture deep-dive
- Tenant provisioning
Identity & data migration
- SAML/OIDC federation
- Role mapping
- EHR export → FHIR import
- Patient consent campaign
Clinical & operational config
- Visit type catalog
- Clinician schedules
- Pharmacy formulary
- Pricing & payer rules
Pilot & training
- Staff dry-run encounters
- Scribe calibration
- Master Equation seeding
- Final acceptance test
Next step
Schedule an architecture review — we'll send the diligence packet ahead.
A 60-minute working session with the architecture team plus the compliance officer. We'll walk the six-layer stack against your environment, scope your deployment model, and surface every question your security review will ask. The diligence packet — BAA, DPA, SOC posture, breach SOP, model cards — lands in your inbox before the call.