Legal clinic scheduling platform requirements (SOC 2 + VPAT)

Who this checklist is for

• Legal aid clinics run by a university law school, nonprofit, or coalition of partner orgs
• Programs coordinating volunteer attorneys, staff, and high-volume client intake
• Teams that need vendor documentation for SOC 2 security and VPAT accessibility compliance

Core product goals (define before you pick a vendor)

1) One backend, multiple role-based experiences

• Separate experiences for:
• Clients (intake, uploads, appointment confirmation)
• Volunteers/attorneys (availability, assignments, case packet access)
• Admins (clinic setup, scheduling rules, reporting)
• Front-end/UI can change over time without breaking core data and scheduling logic.

2) Multi-organization clinic sharing (single platform)

• One unified platform and login; clinics can be branded per event.
• Admins can grant another organization’s admins access to specific clinics.
• Clear access boundaries:
• Organization-level admins
• Clinic-level admins (per event)
• Volunteer-only access
• Client-only access

Intake + document collection requirements

Intake flow

• After a client signs up, the system prompts the intake form automatically.
• Intake supports structured fields + file uploads.
• Admins can require intake completion before appointment confirmation.

Templates by clinic type

• Clinic templates (examples): wills clinic, employment clinic, family law clinic, “know your rights.”
• Each template can define:
• intake questions
• required uploads
• eligibility / pre-qualification steps
• scheduling rules (e.g., longer slots for certain matters)
• Admins can clone and customize templates per clinic.

Document storage (don’t assume OneDrive)

• Document storage must support multi-org access without licensing lock-in.
• Files are permissioned by clinic + role.
• Basic file lifecycle controls:
• retention policy support
• export/download for authorized users
• auditability (who accessed/updated)

Scheduling requirements (the “dynamic” part)

Client-facing scheduling

• Clients can request an appointment and select from eligible times.
• Waitlist support when a clinic fills up.
• Confirmation messages are automatic.

Volunteer/attorney scheduling

• Volunteers set availability windows.
• Admins can assign volunteers to clinics and limit capacity.
• Admin overrides:
• manual rescheduling
• slot holds
• cancellation handling

Operational rules you’ll want early

• Timezone handling (especially if partner orgs span regions).
• Per-clinic rules (e.g., intake required, capacity, eligibility screening).
• Staff-facing visibility into:
• who has completed intake
• which documents are missing
• which slots are confirmed vs pending

Reminder + notification requirements

• Intake incomplete reminder(s)
• Upcoming clinic reminder(s)
• Day-of appointment reminder(s)

• Admin can configure reminder timing per clinic.
• Reminder channels supported (at minimum email; optionally SMS).
• Clear opt-in/consent capture for notifications.

Survey + outcomes measurement requirements

Two surveys: immediate + delayed

• Immediate post-clinic survey:
• attendance confirmation
• satisfaction rating
• “did you receive services” checkbox
• optional short free-response
• Delayed follow-up survey (3–6 months):
• outcomes (e.g., did they apply for a job, resolve an issue)
• additional support needed

Survey templates + per-clinic customization

• Default survey templates that admins can modify.
• Surveys can be turned on/off per clinic.
• Survey links are mobile-friendly.

Compliance + procurement requirements (SOC 2 + VPAT)

• Vendor SOC 2 report and security documentation
• VPAT/accessibility documentation
• Clear data-handling posture:
• encryption at rest + in transit
• access controls and audit logs
• incident response posture

• The platform must not depend on university single sign-on to serve community clients.

Admin experience requirements (what makes this sustainable)

• Clinic setup wizard (or equivalent) that lets admins define:
• branding/logos per clinic event
• intake template
• scheduling rules
• reminders
• survey settings
• Reporting dashboard for:
• signups vs attendance
• intake completion rates
• volunteer capacity utilization
• survey response rates and outcomes

Rollout plan requirements (avoid a “big bang”)

• Support iterative rollout:
• start with one clinic type
• expand to additional clinic templates
• onboard partner orgs next
• Ability to adjust UI and workflows based on feedback.

Scope your legal clinic scheduling platform with Connex