Trust & Security

We are not lawyers and none of this is legal advice, but it is the frame we design inside and it is worth raising with your counsel early. No: California also has the Confidentiality of Medical Information Act, which sits alongside HIPAA. Where state law is more protective than HIPAA, the state rule governs. The difference that matters most to you is enforcement: HIPAA is enforced by regulators and creates no general private right of action, while CMIA lets a patient sue you directly for an unauthorized disclosure. The exposure is therefore not only a federal penalty. It can also be a civil claim from the person whose information moved. That is a large part of why we care where a tool physically stores your records rather than only whether a vendor will sign a form.

Again, not legal advice. They are a distinct category under HIPAA and carry stronger protection than the rest of the record, but that heightened protection only applies if they are in fact kept separately from it. CMIA adds further conditions on releasing outpatient psychotherapy information to a third party without written authorization. If your process notes currently sit in the same place as scheduling and billing, that is worth raising with your counsel, and it is the kind of thing the paid assessment documents properly. Where a build touches them at all, they get their own storage and their own access rules rather than inheriting whatever the case record uses.

Nothing of ours has to keep existing for it to work. The system lives in your own Microsoft 365 account under your admin control. You own the source code and configuration outright, and your team gets written instructions and the documentation at handover. There is no MaxPower Labs cloud in the path, no license key of ours to expire, and no hosting bill of ours that could lapse. What you would need is another developer, so we build with standard Microsoft 365 components rather than anything exotic, specifically so another Microsoft 365 consultant can take it over. That is a deliberate constraint and occasionally a slower way to build. Ask us on the call what would actually be involved, because it is a fair question and the honest answer has some work in it.

Yes. If your counsel prefers your paper, we sign yours. We would rather move quickly on your terms than spend three weeks negotiating whose template wins.

Sometimes, for build work. We tell you this before you ask, name the arrangement in the contract, and require the subcontractor to sign a Business Associate Agreement as well. Subcontractors build against dummy data and receive only scoped, time-limited access to your account when the work genuinely requires it. We remain your sole point of accountability and your sole contracting party.

In your own Microsoft 365 account, covered by your BAA with Microsoft, under your administrative control. We do not host your protected health information. There is no MaxPower Labs cloud that your patient data is copied into, and no third-party analytics service watching your clinical workflow.

Nothing breaks. The system is in your own account, you own the source code, and your administrators keep full control. We hand over documentation and, if you want, brief whoever takes over. There is no lock-in mechanism, because a system you cannot leave is a system you were never really sold.

Tell us what your counsel requires and we will confirm our current coverage in writing before you sign anything. We would rather give you a specific answer against your actual requirement than a vague reassurance on a web page.

Ask us on the call and we will tell you honestly what we can offer at that moment. We are early enough as a firm that we would rather say so than manufacture a reference. What we can always do is walk you through the workflow mapping described on our Proof page in as much detail as you want, including the parts we got wrong. We do not publish client names without written permission, which is the same courtesy we would extend to you.