Built for health systems, provider networks, and health-tech teams: risk assessments, regulatory checklists, exclusion and CIA tracking, and a policy builder. All are free to use and run entirely in your browser.
Score risk, work a regulation section by section, screen people against exclusion lists, or generate a policy. Everything is free and stays in your browser.
Breach risk, Seven Elements, clinical AI, and employment AI, each scored against the rule and handed back as a gap summary.
4 tools Browse Assess tools → CheckHIPAA Security and Privacy, Part 2, California privacy, and multi-state health data, item by item with citations.
5 tools Browse Check tools → Screen & trackExclusion and sanctions screening against LEIE and Medi-Cal, plus a dashboard of active Corporate Integrity Agreements.
2 tools Browse Screen & track tools → BuildOne intake form produces three cited, currency-flagged policy libraries: Privacy, Security, and Compliance.
1 tool Browse Build tools →Short recaps of what moved across HHS, OCR, DOJ, OIG, and California each cycle: one for compliance developments, one for enforcement activity.
A twelve-hospital system, a six-clinic network, and a Series A digital health company carry three different regulatory burdens. The tools below are grouped for the risk each one carries.
Screen every facility's roster against the exclusion lists, track Corporate Integrity Agreement obligations against 66 active settlements, run an enterprise-scale Seven Elements self-assessment, and vet AI tools before they touch PHI.
See health-system tools →Work HIPAA and California's stricter CMIA side by side, draft a breach-notification response before you need one, and run a program self-assessment against the OIG's seven elements.
See provider-network tools →Assess AI risk across BAA terms, de-identification, and Section 1557 nondiscrimination, layer privacy obligations beyond the HIPAA floor, and track the regulatory changes that shape vendor contracting.
See health-tech tools →Supporting intelligence behind the tools: deadlines, enforcement actions, and proposed rules across HHS, OCR, DOJ, OIG, and California.
Practical perspective on the regulations and enforcement trends that shape how a compliance program gets run.
Most programs can name the OIG's seven elements. Far fewer can show them operating. Here's how to tell the difference during a gap analysis.
PrivacyWhy provider networks that build only to the federal standard still carry real exposure under California's stricter privacy regime, and where the gaps usually hide.
AI governanceAmbient scribes and AI coding tools are arriving faster than the contracts covering them. A mapping of each OIG element onto AI risk, and the four places the fit is genuinely imperfect.
Risk defenseA field guide to the transaction reviews that keep fair-market-value and commercial-reasonableness questions from becoming enforcement questions.
Directed compliance operations under active Corporate Integrity Agreements (CIAs) across multi-facility hospital systems.
Brandon Goulter is a healthcare compliance and privacy leader with 18+ years of experience across hospital, multi-facility health-system, and pharmacy environments. His experience includes operating the controls required of a redesigned compliance program under an active Corporate Integrity Agreement (CIA).
He holds a Master's degree in Healthcare Administration with a fraud-management specialization, along with the CHC, CHPS, and RHIA certifications. These tools are the controls he has built and used, turned into something any compliance team can run for free.
The tools are free to use and yours to keep. Send feedback or suggest a tool: a correction, a source that has moved, an edge case a tool does not cover, or a resource you would find useful.
Opens your email client, addressed directly to Brandon.