Home

AttorneyOS — Implementation Plan

Scope: Complete phased execution plan for building AttorneyOS — from database schema through production launch across 4 phases
Date: March 2026
Sources: 17 research documents (250 primary sources), Abrahamson & Uiterwyk operating handbook (88-page SOPs, 9-page PIIS form, Phase 0/1/2 checklists), medref prototype codebase

Executive Summary

AttorneyOS will be built in 4 phases, following a vertical-slice approach: each phase delivers a complete, usable workflow — not isolated modules. The partner firm (Abrahamson & Uiterwyk) validates real cases through every phase.

The execution starts with the post-intake engine (Phase 1) because the research is unambiguous: the 24–72 hour window between intake completion and first document dispatch is the single most structurally unaddressed gap in PI software. No dedicated software category exists for it. Firms manage it on paper calendars and spreadsheets. Missing the Florida 14-day PIP treatment deadline forfeits $10,000 in benefits per case. This is where we deliver value faster than anything else we could build.

The data model is derived directly from the partner firm’s actual operating documents — the 9-page PIIS form (~120 fields), the Immediate Action Memo, the File Opening Directive, and the Phase 1/2 checklists. This is not speculative architecture — every table and every field maps to a real document used daily by a real PI firm.

Infrastructure uses free tiers during development. The security architecture is identical across tiers — RLS, MFA, audit trails, encryption all work on free tiers. When the first firm signs with real patient data, we upgrade to compliant tiers by flipping a billing switch. No code changes, no migration.


1. Strategy at a Glance

$2.18B
PI Software Market
115K
Launch Market Firms
4
Build Phases
16
Modules

1.1 Execution Philosophy

Vertical slice, not module-by-module. Each phase delivers a complete workflow that replaces something the firm currently does manually or across disconnected tools. The research shows the 10 cross-module integration handoffs are where compound value lives — a “Case Manager” module alone is a slightly better dashboard; the post-intake workflow engine is something no competitor offers.

Architecture-first where it’s load-bearing. Five decisions are locked before any feature code: (1) case data model, (2) multi-tenant RLS on every table, (3) append-only audit trail, (4) deadline engine as a first-class system, (5) document template/generation infrastructure. Everything else emerges from feature work.

Partner firm as functional spec. The handbook’s PIIS form, Immediate Action Memo, File Opening Directive, and Phase 1/2 checklists provide more detailed requirements than most product teams ever receive. Every field, every workflow step, every checklist item maps to a feature.

1.2 Competitive Positioning

AttorneyOS is differentiated on four axes simultaneously — no incumbent covers more than one:

  1. Cross-vertical — native modules for PI, construction, and real estate (no competitor serves all three)
  2. Flat-rate — per-office pricing with unlimited users (every competitor charges per-user)
  3. Modular — pick-and-choose modules (competitors sell forced bundles with gated features)
  4. AI-integrated — AI operates on case data in-place (competitors require export to standalone AI tools)

2. Technology Stack

2.1 Stack Decisions

ComponentChoiceWhy
FrameworkNext.js 16 + React 19 + TypeScriptProven in medref prototype; server components, app router
StylingTailwind CSS 4Already in medref; utility-first, fast iteration
DatabaseSupabase (PostgreSQL)RLS for multi-tenancy, real-time subscriptions, auth with MFA, encrypted storage
Supabase PlanFree → Pro ($25) → Team + HIPAA ($949)Free for dev. Pro when hitting limits. Team + BAA when handling real ePHI.
HostingVercel Free → Pro ($20)No ePHI persists on Vercel; all sensitive data in Supabase
AuthSupabase Auth with MFAMFA mandatory under 2026 HIPAA Security Rule
E-SignatureDocuSign API70% market share, HIPAA BAA, 6 SDKs, native legal integrations
Provider DataNPPES NPI RegistryFree, no registration, 5M+ records
LLMClaude APIHaiku for OCR/summarization, Sonnet for demand generation
Certified MailLob.comUSPS legacy API retired Jan 2026; saves $3.15/letter

2.2 Compliance Posture — Two-Tier Approach

Key insight: The security architecture is built from day 1 — RLS, MFA, audit trails, encryption all work identically on free tiers. The expensive part (BAA, HIPAA add-on) is a billing upgrade, not a code change. We build compliant, pay for certification only when real patient data enters the system.
RequirementArchitecture (Built Day 1, Free)Certification (Paid, When Needed)
HIPAA encryptionAES-256 at rest + TLS 1.2+ in transit (Supabase default on all tiers)BAA signed when first firm onboards with real ePHI
HIPAA MFASupabase Auth MFA enabled from day 1 (free)Formally required under BAA
HIPAA BAAN/A during dev — no real ePHISupabase Team + HIPAA add-on ($949/mo) at first signed contract
ABA Model Rule 1.6(c)RLS on every table, audit trails, encryption (all free)Already met by architecture
IOLTAAppend-only ledger, DB CHECK constraints, double-entry (all free Postgres features)Phase 3 — no paid add-on needed
SOC 2 Type IIN/A during early stageVanta/Drata when selling to 10+ attorney firms
Florida BarSupabase/Vercel exceed “adequate encryption customary in industry” even on free tiersAlready met

2.3 Infrastructure Cost — Two Tiers

Development & Pilot (No Real Patient Data)

ServicePlanMonthly Cost
SupabaseFree (then Pro at $25 when hitting limits)$0–25
VercelFree (then Pro at $20)$0–20
Claude APIPay-as-you-go$5–50
DocuSignDeveloper sandbox (free)$0
Domain + misc$15
Total$20–110/mo

This covers the entire development period through partner firm pilot with test data. Full Postgres, auth, storage, real-time, hosting, AI — everything needed to build and demo the complete product.

Production (First Signed Contract with Real ePHI)

ServicePlanMonthly Cost
SupabaseTeam ($599) + HIPAA add-on ($350)$949
VercelPro$20
Claude APIPay-as-you-go$50–200
DocuSignStarter$50
Domain + misc$15
Total$1,085–1,235/mo

Activated only when the first firm signs and real patient medical records enter the system. The upgrade is a billing switch — no code changes, no data migration, no architectural changes.

What changes between tiers? Only the Supabase billing plan and BAA signature. The code, schema, RLS policies, MFA, audit trails, and encryption are identical. We build to production security standards from day 1 — we just don’t pay for the formal compliance certification until revenue justifies it.

3. Data Architecture

Derived directly from the partner firm’s 9-page PIIS form (~120 fields), Immediate Action Memo, File Opening Directive, and Phase 1 Checklist. Every table maps to a real document or workflow.

3.1 Entity Relationship Overview

firms (multi-tenant root)
  ├  contacts — all people: clients, attorneys, adjusters, witnesses, providers
  ├  cases (the universal entity)
      ├  incidents — accident/event details, MVA-specific fields
      ├  defendants[] — multiple per case, linked to insurance sources
      ├  passengers[] — multiple per case
      ├  insurance_sources[] — up to 8+ per case (the critical multi-source tracker)
      ├  injuries — checklist + categorization (Cat 1–4)
      ├  medical_referrals[] — provider referrals with appointment tracking
      └    └  treatment_records[] — visit-level data
      ├  documents[] — templates + generated + uploaded, lifecycle tracking
      ├  deadlines[] — first-class engine with calculation rules & escalation
      ├  liens[] — per-provider with perfection deadline tracking
      └  case_tasks[] — paralegal workflow from Immediate Action Memo / FOD
  └  audit_log (append-only — NO UPDATE, NO DELETE)

3.2 Key Schema Design Decisions

DecisionRationale
insurance_sources is a single flat table with source_type enumNot 8 separate tables. Enables cross-source queries (total coverage, dependency chain, exhaustion sequencing). priority_order field handles UM/UIM sequencing.
contacts is polymorphic (all people in one table)Simpler joins, full-text search across all contacts. type discriminates. Provider fields (NPI, specialty) nullable for non-providers.
deadlines is first-class with calculation rulesNot embedded in other tables. Background job computes due dates from source events and fires escalation alerts. Powers PIP 14-day, SOL, lien perfection, Medicare reporting from one engine.
documents tracks full lifecycleTemplate → merge-field population → send → sign → file. merge_data JSONB captures what case data generated the document.
audit_log is immutablePostgres trigger blocks UPDATE/DELETE. Every write to sensitive tables logs full before/after state. Compliance backbone for IOLTA and HIPAA.
SSN stored with column-level encryptionVia Supabase Vault or pgcrypto. All other PII protected by RLS + TLS + AES-256 at rest.
JSONB for structured-but-variable dataPhone numbers, injury checklists, citations, photographs, escalation chains — known structure, variable cardinality. Avoids join explosion.

3.3 Multi-Tenant Isolation

Every table carries a firm_id column with Row Level Security (RLS) policies enforced at the PostgreSQL level. A query from Firm A can never return Firm B’s data — this is the foundation of attorney-client privilege in a multi-tenant system. RLS is not optional, not “Phase 2” — it ships on every table in the first migration.


4. Phase Roadmap

Phase 1: The Post-Intake Engine
Phase 1
After this phase, a paralegal can enter a new PI MVA case and have the system auto-generate all first-action documents, track the PIP deadline, and initiate medical referrals — replacing the Immediate Action Memo paper process.

1A. Foundation

1B. Digital Intake

1C. Post-Intake Automation

1D. Medical Referral

1E. Case Dashboard

Case Manager Deadlines Medical Referrals Insurance Documents (partial)
Phase 2: Treatment-to-Demand Pipeline
Phase 2
After this phase, firms can track treatment across all cases, monitor gaps, manage all 9 Florida PI document types, track liens, generate AI-assisted demand packages, and begin consolidating their workflow away from Total Office with Outlook sync, conflict checking, and a full document vault.

2A. Document Management & Vault

2B. Multi-Insurance Enhancement

2C. Treatment & Lien Management

2D. AI Demand Assistant

2E. Total Office Migration Features

Why Phase 2, not Phase 1: During the parallel run, firms still use Total Office for existing cases. Conflict check data lives in TO’s database (years of history) — checking against 5–10 new cases in AttorneyOS is meaningless. Outlook already syncs from TO — a second system pushing tasks creates noise. These features become essential when AttorneyOS has enough case volume that it’s becoming the primary system, which is Phase 2 territory.
Documents Document Vault Lien Tracker AI Assistant Insurance (enhanced) Outlook Sync Conflict Check
Phase 3: Settlement & Financial
Phase 3
After this phase, firms can calculate compliant disbursements, manage IOLTA trust accounting, process lien negotiations, give clients a portal, and handle e-signatures — the full case lifecycle.

3A. Settlement Calculator

3B. Trust Accounting

Zero-defect module. A trust accounting bug can end an attorney’s career. This module gets property-based tests, formal verification of overdraft prevention, and mandatory shadow mode before any firm goes live.

3C. Billing & Expenses

3D. Client Portal

3E. E-Signature Integration

3F. Workflow Builder & Full Outlook Sync

Why Phase 3: By now we have multi-firm usage data showing which parts of the workflow firms want to customize vs. which are universal. Building the abstraction before understanding the variation is premature architecture. Also, full bi-directional Outlook sync is the “we’re your primary system now” feature — it belongs here, after trust accounting makes the full TO replacement possible.
Billing Trust Accounting Client Portal E-Signature Workflow Builder Outlook (full sync)
Phase 4: Growth & Network
Phase 4
After this phase, firms can refer cases to other attorneys (viral growth), migrate from any major competitor for free, manage their intake pipeline, and access firm-wide analytics.

4A. Referral Network

4B. Data Migration Engine

4C. Pipeline / CRM

4D. Analytics

4E. Enterprise Security

Referral Network Pipeline Migration Engine Analytics SAML SSO Enterprise Security

5. Risk Register

RiskLikelihoodImpactMitigation
Phase 1 scope creep on data modelMediumMediumLock schema for PI MVA only. Extension points for verticals but don’t build them.
Phase 1 scope too largeMediumMediumDe-scope to core workflow (intake + LOR + PIP + referral). Dashboard can be minimal v1.
Trust accounting bugsLowCatastrophicPhase 3 (production experience first). Property-based tests. Shadow mode. Hard DB constraints.
SOC 2 absence blocks enterpriseCertainMediumFocus on solo/small firms first. Add Vanta when moving upmarket.
Competitor respondsLow (18–36mo)HighVelocity. Every firm acquired before response is structural retention via data lock-in.
HIPAA 2026 rule stricter than NPRMMediumMediumAlready building to NPRM spec. Buffer for additional requirements.
Partner firm workflows non-standardLowLowLarge firm = superset. Solo practitioners skip steps they don’t need.

6. Success Metrics

MetricPhase 1Phase 2Phase 3Phase 4
Firms on platform1 (partner)5–1025–50100+
Cases processed5–1050+200+1,000+
PIP deadlines caughtTrackMeasure savesReport $ savedMarketing proof point
Treatment gaps preventedTrackMeasure reductionReport impactMarketing proof point
Paralegal time savedBaseline30%+ reduction50%+ reductionBenchmark & publish

7. Additional Scope Elements


8. Handbook Document Mapping

Every document from the partner firm’s operating handbook maps directly to an AttorneyOS feature:

Handbook DocumentPhaseAttorneyOS Feature
PIIS MVA (9-page form)1Digital intake wizard
Immediate Action Memo1Post-intake automation engine
File Opening Directive1Auto-generated case setup checklist
Letter of Representation1Template with merge fields
Phase 1 Checklist (MVA)1Paralegal task engine
Phase 1 Checklist (PL)1Premises liability variant
New Auto Case Setup1Direct transfer workflow
CFA / SOCR (fee agreement)3DocuSign e-signature
Settlement Summary3Disbursement calculator
Demand template2AI-assisted demand generation
CME Checklist2Litigation checklist
Deposition Checklist2Litigation checklist
Mediation Checklist2Litigation checklist
Trial Checklist2Litigation checklist
Rejection letter4Pipeline: case rejection workflow
Initial Client Conference Notes1Case notes system
Medicaid Authorization1Collateral source letters