For owner-led psychology, behavioral health & medical practices in LA and Ventura Counties # Your practice runs on tools that were never built for PHI. A regional-center referral arrives as a PDF attached to an email from a case manager who has spelled the client’s name two different ways. The authorization number is in the email body, not the attachment. Your coordinator re-types all of it into a Trello board, then a spreadsheet, then another spreadsheet at year end. Trello boards. Google Forms. A shared sheet somebody rebuilt after the last crash. They work — that’s why your team uses them. But none of them are covered by a BAA, and all of them sit in the category regulators are actually citing. **We map the workflow your team already runs, then rebuild it inside your own Microsoft 365 tenant** — same boards, same habits, with per-clinician record-level permissions and an audit trail underneath. [Book a Free 30-Minute Workflow Review](https://calendar.google.com/calendar/u/0/appointments/schedules/AcZssZ3LqPtiKILlvoAI3-Q496e-zr30WO1qiVmgMdT7r9X5jVE_2OWxm1tu68fxrZ7aDoCQW0XBYRmU) [Check your practice in 60 seconds →](https://maxpowerlabs.ai#selfcheck) No slides. No pitch. We map one workflow on the call and tell you what we’d do about it — including “nothing, you’re fine.” **MaxPower Labs builds HIPAA-aware workflow systems for owner-led medical and behavioral health practices of roughly 5–50 staff** across Ventura County, Los Angeles County and the San Gabriel Valley. We map the workflow a practice already runs, then rebuild it inside the practice’s own BAA-covered Microsoft 365 tenant with record-level per-clinician permissions. **Every price is published:** a 30-minute workflow review is free, the AI & Compliance Readiness Assessment is $3,000, an Automation Sprint is $5,000, and platform builds run $44,200–$72,300, each plus $1,500 per month of Platform Care. --- What we actually do ## We start by watching how the work really happens Most vendors arrive with a product and ask which parts you want. We arrive with a notepad. Before anything is built, we sit with the person who actually runs the workflow and map it — every stage, every handoff, every place they re-type the same thing into a fourth system. That map is the deliverable. It’s usually the first time anyone has written their job down. And it’s where the money turns out to be hiding — not in the compliance gap that got our attention, but in the hours each week your coordinator spends moving data between tools that don’t talk to each other. ### What you get - **The same kanban your team already knows** — boards, cards, labels, drag-and-drop. Not a new system to learn. - **Per-clinician record-level permissions** — a therapist sees their own cases and nobody else’s, enforced at the data layer, identical on desktop and phone. - **Intake that lands inside the compliance boundary** — Microsoft Forms into your own tenant, not a consumer form tool. - **Automatic notifications and reminders** — due dates, overdue escalation, daily digests. The nagging stops being a person’s job. - **Reporting that replaces the shadow spreadsheets** — the ones three people maintain by hand for the year-end report. - **Everything inside your own Microsoft 365 tenant** — your BAA, your data, your admin control. [Where the hours go] ### The pattern we keep finding In one behavioral health practice we mapped, the intake coordinator was re-entering referral data by hand from emailed PDFs — then again into a tracking board, then again into a spreadsheet kept purely because contractors couldn’t be given access to the real one, then again for the year-end count. **Four systems. One piece of information. A large share of her week.** Nobody had ever mapped it, so nobody had ever costed it. The compliance gap is what gets a practice’s attention. This is what actually pays for the fix. [See the full workflow map →](https://maxpowerlabs.ai/proof.html) [That’s my practice — book the free review](https://maxpowerlabs.ai/contact.html#book) --- ## Self-check tool This page carries an interactive six-question self-check that returns a practice's own HIPAA exposure findings and duplicate-data-entry cost arithmetic. It runs entirely in the browser, requires no email address, and stores nothing. Side by side ## What the tools you use now can and cannot do Not a knock on any of them. Trello, Google Forms and spreadsheets are good software that was never designed to hold protected health information. | What you need | Trello, Google Forms, spreadsheets | Microsoft 365 in your own tenant | | **A signed healthcare BAA** | **No** — Atlassian does not sign a healthcare BAA on Trello’s free or Standard tiers. Ordinary Google Forms, Typeform and JotForm accounts are not covered either. | **Yes** — Microsoft signs one, and it is your agreement, in your name. | | **Record-level privacy** | **Board-level only.** Anyone added to a board sees every card on it. You cannot share one client’s workflow without exposing the rest of the caseload. | **Per-clinician, per-record** — enforced at the data layer, so it behaves the same on desktop and phone rather than being hidden in the interface. | | **A usable audit trail** | **No.** You can see that a card moved. You cannot prove who *viewed* what, or when — which is the first thing asked for when a record is questioned. | **Tenant-wide audit log** covering access, not just changes. | | **Intake that stays inside the boundary** | Consumer form tools sit outside it. A disclaimer saying the form is not secure documents that you knew. | **Microsoft Forms** — same experience for the patient, responses land straight in your tenant. | | **The kanban your team already knows** | **Yes** — and that is exactly why nobody wants to leave. | **Yes.** Same boards, same cards, same drag-and-drop. That is the entire design constraint. | | **Where the data actually lives** | A third party’s cloud, on terms you did not negotiate. | **Your tenant, your admin control** — and you own the source code and configuration outright. | [ See a sample of what an assessment actually produces (PDF) →](https://maxpowerlabs.ai/samples/Sample-Assessment-Findings.pdf) --- How engagements work ## Four steps. Every price published. You should never receive a number from us that you haven’t already seen on this website. Each step is small enough to say yes to on its own, and each one earns the next. ### Workflow Review 30 minutes. We map one workflow live and tell you what we’d do about it — or that you don’t need us. Price: Free — 30 minutes ### AI & Compliance Readiness Assessment Two weeks. A documented security risk analysis, an inventory of every AI and cloud tool already in use, a one-page acceptable-use policy, and an automation roadmap costed in hours saved. Price: $3,000 — credits toward the build ### Automation Sprint One workflow off the roadmap, fixed scope, built and live in your tenant. Price: $5,000 — + $1,500/mo care ### Platform Build The whole operation: every workflow, the privacy engine, intake, notifications, reporting, records move, training and post-launch support. Price: $44,200–$72,300 — + $1,500/mo care [Full pricing, in detail →](https://maxpowerlabs.ai/pricing.html) --- Before your attorney asks ## The answers you need in writing A vendor going inside a tenant that holds PHI should answer these before you have to ask. Ours are on one page, in plain language. ### We sign a BAA Before work begins, not after. Yours or ours. Every subcontractor signs one too — and we tell you we use them up front. ### You own it Deployment, source code, data, workflows and configuration. Transfers on final payment. Hire someone else tomorrow if you want. ### It lives in your tenant Your Microsoft 365, your BAA with Microsoft, your admin control. We don’t host your PHI. Build uses dummy data only. ### We come to you The discovery deep-dive is on-site in Pasadena, Glendale, the San Gabriel Valley or wherever you are. Travel is included in every price here — you will never see a mileage line. [Read the full Trust & Security page →](https://maxpowerlabs.ai/trust.html) --- ## Questions we get asked first **Q: Will you sign a BAA?** Yes — before any engagement where we could encounter PHI, and before work starts rather than after. Any subcontractor we use signs one too, and we disclose that we use subcontractors up front rather than leaving your attorney to find it. If you’d rather use your own BAA form, we’ll sign yours. **Q: Is my practice too small for this?** We work specifically with owner-led practices of roughly 5–50 staff, no internal IT, and real regulatory exposure. That’s the entire design target. If a full platform isn’t right, the $5,000 Automation Sprint covers one workflow — and the free review will tell you honestly which rung you belong on, including none of them. **Q: We’re not on Trello. Does this still apply?** Yes. Trello is the most common version of the problem, not the definition of it. The same pattern shows up with Google Forms intake, Asana, Monday, Notion, shared spreadsheets, email-based referrals and paper. What matters is whether the tool holding your patient information is covered by a BAA, and whether the work is being re-typed between systems. **Q: Who owns what you build?** You do — deployment, source code, data, workflows, configuration — transferring on final payment, inside your own tenant with full admin control. Your administrators get **the runbook, the access and the documentation**, so you can run it without us. You’re free to modify it or hire a different developer. We retain only our pre-existing general-purpose components and methods (we call them Background Tools), and that carve-out is written plainly into every contract rather than buried in an appendix. **Q: What happens to our historical data?** You keep it. We export every board, list, card, attachment and comment, quarantine anything that should not be migrated, and import with **original timestamps preserved** — so a case opened in 2019 still reads as opened in 2019. Your active records always move as part of the build. A deep multi-year archive is quoted separately, because volume varies enormously between practices, not because your history is optional. **Q: What about our intake forms?** If your intake form collects clinical detail through a vendor that will not sign a BAA, that is its own exposure — and **Typeform, JotForm and ordinary Google Forms accounts generally are not covered**. We replace it with Microsoft Forms: the same field experience for the patient, a BAA that is already yours through Microsoft, and responses landing directly in your own tenant instead of a third party’s. **Q: How long does it take?** The assessment is two weeks. An Automation Sprint is typically three to four weeks. A full platform build runs nine to twelve weeks across six milestone phases — discovery, data layer and first board, remaining boards and automation, your team’s testing and sign-off, go-live and training, then post-launch support. You sign off at each phase; it isn’t finished until you say so. **Q: What if we just want to know where we stand?** That’s what the assessment is for. Two weeks, $3,000, and you keep everything it produces whether or not you build anything with us: a documented security risk analysis, an inventory of every AI and cloud tool already in use across your practice, a one-page acceptable-use policy, and a prioritised roadmap costed in hours saved. If you do go ahead, the fee credits toward the build. --- ## Start with the free half hour Bring one workflow — the one that annoys you most. We’ll map it on the call and tell you plainly what we’d do, what it would cost, and whether it’s worth doing at all. [Book a Free 30-Minute Workflow Review](https://calendar.google.com/calendar/u/0/appointments/schedules/AcZssZ3LqPtiKILlvoAI3-Q496e-zr30WO1qiVmgMdT7r9X5jVE_2OWxm1tu68fxrZ7aDoCQW0XBYRmU) ### You’ll be talking to Paul **Paul Tran** — founder, MaxPower Labs. I run every one of these calls myself. Not a salesperson, not a junior — the person who will sit with your coordinator and map the workflow. Evening and early-morning slots available  ·  [paul@maxpowerlabs.ai](mailto:paul@maxpowerlabs.ai) ---