The rules are written down. Keeping a program current is the harder part.
I'm Dan Gonzalez. I hold the compliance officer function for healthcare organizations that don't have one: the security risk analysis HIPAA requires, behavioral health programs kept aligned when their rules move, and governance for the AI already in your building, run month over month. I built these programs from the inside at regulated technology companies: HITRUST certifications, SOC 1 and SOC 2 audits, CMS authorization processes, hundreds of BAA negotiations. Every price is published up front.
I wrote the software my own engagements run on.
Rote Compliance is a compliance platform I architected and built solo, and I use it on my own engagements. It reads business associate agreements against 45 CFR 164.504(e)(2), maps a policy set to framework controls, and runs gap analysis with every finding cited to the document it came from. That is most of the mechanical reading in a compliance program, and it is the part that used to crowd out the judgment.
Building it is also where I learned to deploy generative AI properly: the model carries the mechanical reading, and judgment and decision-making stay with a human reviewer who signs the finding. That division is the design, not a limit I ran into. It is why I can tell you precisely what an automated pass covers and what it does not, and why the assessment includes a walkthrough instead of a longer questionnaire.
The method is open source. Every compliance skill the platform runs is published and free to read, and they have crossed 10,100 downloads on ClawHub, alongside the HIPAA guides. The Part 2 notice study runs on one of them.
The engagements are here. The method and the software are at rotecompliance.com.
The compliance officer function, starting with the analysis.
At most organizations this size, compliance belongs to someone who also runs billing or IT. The work happens when something forces it: a renewal, a MIPS attestation, a buyer's security questionnaire, a rule that changed.
The fractional compliance officer retainer gives that work an owner. Policies current, the risk register live, BAAs and training tracked, the annual analysis refreshed on schedule, and a person to call when a question lands. From $2,500/mo, which is under a third of what the function costs as a hire.
If you do not have a current risk analysis, month one is that analysis, billed at the assessment price. Every month after is the monthly price. That analysis is the one 45 CFR 164.308(a)(1)(ii)(A) requires, every finding evidence-cited, and I come on site to do it. 45 CFR 164.310 is about the physical environment, and you cannot assess a physical environment through a questionnaire.
If you only need the analysis, it is sold on its own, from $3,500.
Four settings, four different reasons the call happens.
The work behind the engagements.
Credentials
Juris Doctor with a Health Law Certificate, Saint Louis University School of Law. BA in Psychology and Comparative Sociology, University of Puget Sound. I went straight from law school into healthcare compliance rather than practice, because the work was more technical and more directly tied to outcomes.
Delivered
Vendor management programs, security frameworks across AWS, Google Cloud and Azure, and compliance training that engineers and ops teams actually finished. Incident responses, program launches, and the unglamorous work of reading the actual CFR provisions and deciding what they mean for one specific system architecture.
How I work
In the room when architecture decisions get made, vendors get evaluated, and governance frameworks get built, not an advisor rotating through quarterly calls. Close enough to the work that the risk register reflects what you actually run, not what a questionnaire said you run.
Start with a call.
Thirty minutes, no charge. Tell me what triggered the search: a renewal, an audit, a buyer's security questionnaire, a rule that changed. I'll tell you what you actually need and what it costs.