For owner-led psychology, behavioral health & medical practices in Ventura County, LA County and the San Gabriel Valley
Your practice runs on tools that were never built for PHI.
We map the workflow your team already runs, then rebuild it inside the Microsoft 365 account your practice already owns. Same boards, same habits, with per-clinician record-level permissions and an audit trail underneath. Fixed price, published on this site, and you own what we build.
Trello boards. Google Forms. A shared sheet somebody rebuilt after the last crash. They work, and that’s why your team uses them. They also mean somebody re-types the same client’s details into four places before lunch. And none of them are covered by a Business Associate Agreement, the contract HIPAA requires before an outside company can touch patient information. Most people call it a BAA.
A new client emails at 9pm. Your coordinator copies the details into a Trello card in the morning, again into the intake spreadsheet, again into the billing system, and once more into the sheet somebody keeps for the year-end count. Four times, same information, before anyone has seen a client.
No slides. No pitch. We map one workflow on the call and tell you what we’d do about it, including “nothing, you’re fine.”
MaxPower Labs builds HIPAA-aware workflow systems for owner-led medical and behavioral health practices of roughly 5–50 staff across Ventura County, Los Angeles County and the San Gabriel Valley. We map the workflow a practice already runs, then rebuild it inside the practice’s own BAA-covered Microsoft 365 account with record-level per-clinician permissions. Every price is published: a 30-minute workflow review is free, the AI & Compliance Readiness Assessment is $3,000, an Automation Sprint is $5,000, and platform builds run $44,200–$72,300, each plus $1,500 per month of Platform Care.
What we actually do
You see your own operation written down first
Most vendors arrive with a product and ask which parts you want. We arrive with a notepad. Before anything is built, we sit with the person who actually runs the workflow and map it: every stage, every handoff, every place they re-type the same thing into a fourth system.
That map is the deliverable. For a lot of operational leads it is the first time anyone has asked them to write the job down. And it’s where the money turns out to be hiding. Not in the compliance gap that got our attention, but in the hours each week your coordinator spends moving data between tools that don’t talk to each other.
What you get
- The same boards and cards your team already knows. Boards, cards, labels, drag-and-drop. Not a new system to learn.
- Per-clinician record-level permissions. A therapist sees their own cases and nobody else’s, so the phone app cannot show it either, because the rule lives with the record rather than the screen.
- Intake that lands somewhere Microsoft has signed a BAA for. Microsoft Forms into your own Microsoft 365 account, not a consumer form tool.
- Automatic notifications and reminders. Due dates, overdue escalation, daily digests. The nagging stops being a person’s job.
- Reporting that replaces the shadow spreadsheets. The ones three people maintain by hand for the year-end report.
- Everything inside your own Microsoft 365 account. Your BAA, your data, your admin control.
Where the hours actually go
In one behavioral health practice we mapped, the intake coordinator was re-entering referral data by hand from emailed PDFs, then again into a tracking board, then again into a spreadsheet kept purely because contractors couldn’t be given access to the real one, then again for the year-end count.
Nobody had ever mapped it, so nobody had ever costed it. The compliance gap is what gets a practice’s attention. This is what actually pays for the fix.
What you would actually notice
What changes on a Tuesday
The point is not the software. It is that a handful of specific daily irritations stop happening. Each one below is what the system does by design, not a result we are reporting back from somewhere else.
The same client stops being typed in four times. The details arrive once and land in the board. The year-end count becomes a report somebody runs, not two days of tallying by hand.
A therapist opens their phone and sees their own caseload. Not a filtered view they could click their way out of. The rule lives with the record, so the phone app cannot show them anybody else’s clients either.
Intake stops arriving through a tool nobody signed a BAA with. Same experience for the client, same questions. The responses land inside your own Microsoft 365 account instead of a vendor’s.
Nobody has to remember to chase anything. Due dates, overdue reminders and a daily digest take over the nagging that is currently somebody’s job.
And when your attorney asks whether the system holding clinical notes is covered by a Business Associate Agreement, the answer is yes, and you can produce it.
60 seconds, no email required
Where does your practice actually stand?
A majority of recent HIPAA enforcement actions cite a missing or inadequate security risk analysis. In 2025 the Office for Civil Rights resolved 21 HIPAA settlements in total, the second-highest annual total on record, and behavioral health provider Deer Oaks paid $225,000 in July 2025 in exactly that category. Sources →
Six questions about tools you already use. You get your own exposure profile and your own hours-saved arithmetic, on this page, immediately, with nothing to fill in and nobody calling you afterwards.
Self-check run at maxpowerlabs.ai. Six questions, no data sent anywhere.
What we’d do about it
Nothing here was sent anywhere. This ran entirely in your browser. Your answers are not submitted or tracked, and there is no follow-up unless you tick the box above or you book a call yourself.
Side by side
What the tools you use now can and cannot do
Not a knock on any of them. Trello, Google Forms and spreadsheets are good software that was never designed to hold protected health information.
| What you need | Trello, Google Forms, spreadsheets | Microsoft 365 in your own Microsoft 365 account |
|---|---|---|
| A signed healthcare BAA | No. Atlassian does not sign a healthcare BAA on Trello’s free or Standard tiers. Ordinary Google Forms, Typeform and JotForm accounts are not covered either. | Yes. Microsoft signs one, and it is your agreement, in your name. |
| Record-level privacy | Board-level only. Anyone added to a board sees every card on it. You cannot share one client’s workflow without exposing the rest of the caseload. | Per-clinician, per-record. Enforced on the record itself, so it behaves the same on desktop and phone rather than being hidden in the interface. |
| A usable audit trail | No. You can see that a card moved. You cannot prove who viewed what, or when, which is the first thing asked for when a record is questioned. | Account-wide access log covering access, not just changes. |
| Intake that stays inside the boundary | Consumer form tools sit outside it. A disclaimer saying the form is not secure documents that you knew. | Microsoft Forms. Same experience for the patient, responses land straight in your own account. |
| The boards your team already knows | Yes, and that is exactly why nobody wants to leave. | Yes. Same boards, same cards, same drag-and-drop. That is the entire design constraint. |
| Where the data actually lives | A third party’s cloud, on terms you did not negotiate. | Your account, your admin control, and you own the source code and configuration outright. |
See a sample of what an assessment actually produces (PDF) →
How engagements work
Start small. You decide if there is a step two.
You should never receive a number from us that you haven’t already seen on this website. Each step is small enough to say yes to on its own, and each one earns the next.
Workflow Review
30 minutes. We map one workflow live and tell you what we’d do about it, or that you don’t need us.
AI & Compliance Readiness Assessment
Two weeks. A documented security risk analysis, an inventory of every AI and cloud tool already in use, a one-page acceptable-use policy, and an automation roadmap costed in hours saved.
Automation Sprint
One workflow off the roadmap, fixed scope, built and running in your own Microsoft 365 account.
Platform Build
The whole operation: every workflow, the per-clinician privacy rules, intake, notifications, reporting, records move, training and post-launch support.
Before your attorney asks
The answers you need in writing
A vendor going inside the account that holds your patient records should answer these before you have to ask. Ours are on one page, in plain language.
We sign a BAA
Before work begins, not after. Yours or ours. Every subcontractor signs one too, and we tell you we use them up front.
You own it
Deployment, source code, data, workflows and configuration. Transfers on final payment. Hire someone else tomorrow if you want.
It lives in your tenant
Your Microsoft 365, your BAA with Microsoft, your admin control. We don’t host your PHI. Build uses dummy data only.
We come to you
The discovery deep-dive is on-site in Pasadena, Glendale, the San Gabriel Valley or wherever you are. Travel is included in every price here. You will never see a mileage line.
Questions we get asked first
Will you sign a BAA?
Yes, before any engagement where we could encounter PHI, and before work starts rather than after. Any subcontractor we use signs one too, and we disclose that we use subcontractors up front rather than leaving your attorney to find it. If you’d rather use your own BAA form, we’ll sign yours.
Is my practice too small for this?
We work specifically with owner-led practices of roughly 5–50 staff, no internal IT, and real regulatory exposure. That’s the entire design target. If a full platform isn’t right, the $5,000 Automation Sprint covers one workflow, and the free review will tell you honestly which step fits, including none of them.
We’re not on Trello. Does this still apply?
Yes. Trello is the most common version of the problem, not the definition of it. The same pattern shows up with Google Forms intake, Asana, Monday, Notion, shared spreadsheets, email-based referrals and paper. What matters is whether the tool holding your patient information is covered by a BAA, and whether the work is being re-typed between systems.
Who owns what you build?
You do: deployment, source code, data, workflows and configuration, all transferring on final payment, inside your own Microsoft 365 account with full admin control. Your administrators get written instructions, the passwords and the documentation, so you can run it without us. You’re free to modify it or hire a different developer. We retain only our pre-existing general-purpose components and methods (we call them Background Tools), and that carve-out is written plainly into every contract rather than buried in an appendix.
What happens to our historical data?
You keep it. We export every board, list, card, attachment and comment, quarantine anything that should not be migrated, and import with original timestamps preserved, so a case opened in 2019 still reads as opened in 2019. Your active records always move as part of the build. A deep multi-year archive is quoted separately, because volume varies enormously between practices, not because your history is optional.
What about our intake forms?
If your intake form collects clinical detail through a vendor that will not sign a BAA, that is its own exposure, and Typeform, JotForm and ordinary Google Forms accounts generally are not covered. We replace it with Microsoft Forms: the same field experience for the patient, a BAA that is already yours through Microsoft, and responses landing directly in your own Microsoft 365 account instead of a third party’s.
How long does it take?
The assessment is two weeks. An Automation Sprint is typically three to four weeks. A full platform build runs nine to twelve weeks across six milestone phases: discovery, the foundation and your first board, the remaining boards and automation, your team’s testing and sign-off, go-live and training, then post-launch support. You sign off at each phase; it isn’t finished until you say so.
What if we just want to know where we stand?
That’s what the assessment is for. Two weeks, $3,000, and you keep everything it produces whether or not you build anything with us: a documented security risk analysis, an inventory of every AI and cloud tool already in use across your practice, a one-page acceptable-use policy, and a prioritized roadmap costed in hours saved. If you do go ahead, the fee credits toward the build.
Start with the free half hour
Bring one workflow, the one that annoys you most. We’ll map it on the call and tell you plainly what we’d do, what it would cost, and whether it’s worth doing at all.
You’ll be talking to Paul
Paul Tran, founder, MaxPower Labs. I run every one of these calls myself. Not a salesperson, not a junior, but the person who will sit with your coordinator and map the workflow.
Evening and early-morning slots available · paul@maxpowerlabs.ai