Built for health systems, provider networks, and health-tech teams: risk assessments, regulatory checklists, exclusion and CIA tracking, and a policy builder. All are free to use and run entirely in your browser.
Published Oct 11, 2026
Week of Oct 11, 2026: report published; corrected edition.
Read the stories
Published Oct 11, 2026
Week of Oct 11, 2026: report published; corrected edition.
Read the stories
Published Oct 11, 2026
Week of Oct 11, 2026: report published; corrected edition.
Read the storiesAssess risks, check regulatory requirements, screen exclusion lists, and draft policies. These free tools run in your browser.
Assess breach risk, the Seven Elements, clinical AI, and employment AI, with summaries of identified gaps.
4 tools Browse Assess tools → CheckHIPAA Security and Privacy, Part 2, California privacy, and multi-state health data, item by item with citations.
5 tools Browse Check tools → Screen & trackExclusion and sanctions screening against LEIE and Medi-Cal, plus a dashboard of active Corporate Integrity Agreements.
2 tools Browse Screen & track tools → BuildUse one intake form to draft Privacy, Security, and Compliance policies with citations and source-currency notices.
1 tool Browse Build tools →Find tools for health systems, clinics, and digital health companies, grouped by common compliance needs.
Screen every facility's roster against the exclusion lists, track obligations across active Corporate Integrity Agreements, run an enterprise-scale Seven Elements self-assessment, and vet AI tools before they touch PHI.
See health-system tools →
Work HIPAA and California's stricter CMIA side by side, draft a breach-notification response before you need one, and run a program self-assessment against the OIG's seven elements.
See provider-network tools →
Assess AI risk across BAA terms, de-identification, and Section 1557 nondiscrimination, layer privacy obligations beyond the HIPAA floor, and track the regulatory changes that shape vendor contracting.
See health-tech tools →Supporting intelligence behind the tools: deadlines, enforcement actions, and proposed rules across HHS, OCR, DOJ, OIG, and California.
Practical perspective on the regulations and enforcement trends that shape how a compliance program gets run.
Most programs can name the OIG's seven elements. Far fewer can show them operating. Here's how to tell the difference during a gap analysis.
Why provider networks that build only to the federal standard still carry real exposure under California's stricter privacy regime, and where the gaps usually hide.
Ambient scribes and AI coding tools are arriving faster than the contracts covering them. A mapping of each OIG element onto AI risk, and the five places the fit is genuinely imperfect.
A field guide to the transaction reviews that keep fair-market-value and commercial-reasonableness questions from becoming enforcement questions.
Directed compliance operations under active Corporate Integrity Agreements (CIAs) across multi-facility hospital systems.
Brandon Goulter is a healthcare compliance and privacy leader with 18+ years of experience across hospital, multi-facility health-system, and pharmacy environments. His experience includes operating the controls required of a redesigned compliance program under an active Corporate Integrity Agreement (CIA).
He holds a Master's degree in Healthcare Administration with a fraud-management specialization, along with the CHC, CHPS, and RHIA certifications. These tools are the controls he has built and used, turned into something any compliance team can run for free.
The tools are free to use and yours to keep. Send feedback or suggest a tool: a correction, a source that has moved, an edge case a tool does not cover, or a resource you would find useful.
Opens your email client, addressed directly to Brandon.