The buyer isn't grading your answers. They're looking for a compliance program.
A security questionnaire, a BAA redline, a request for SOC 2 or HITRUST: each is a health system or payer asking whether someone at your company runs compliance as an ongoing job. For a young company, an audit is supposed to be the evidence that a program exists. It only works if there is a program for it to find.
Four requests, one question underneath.
A questionnaire answered from scratch for each buyer, or an audit passed by a program that stops running the week after, has to be rebuilt for the next one. A program that runs month over month answers the next request with what it already produces.
The program, run month over month, starting with the analysis.
The risk analysis
The risk analysis 45 CFR 164.308(a)(1)(ii)(A) requires, with your AI surface in scope as standard. Produces the risk register, the risk management plan and the attestation-ready summary letter the rest of the program is built on. Billed in place of the first month's fee, not on top of it. What it covers.
The program, month over month
For when the answer to "who owns compliance" cannot keep being "the CTO." Policies current, the risk register live, BAAs and training tracked, the analysis refreshed, and board reporting, for under a third of a hire. When the audit comes, it has something to find. No minimum term. The comparison, worked.
Already have a current risk analysis that holds up? Month one is an ordinary month at the monthly price. Only need the analysis? It is sold on its own. And if it is one AI vendor holding the deal rather than your whole posture, the AI Vendor Analysis checks that vendor's public claims against its own legal language and against HIPAA.
I built the compliance function at companies like yours.
Inside regulated technology companies I built programs rather than maintaining them: HITRUST certifications, SOC 1 and SOC 2 audits, CMS authorization, and hundreds of BAA negotiations against 45 CFR 164.504(e)(2). I have been the person answering the questionnaire and the person the auditor asked for evidence, which is why the program is built to produce what both of them want to see.
I also wrote the software. Rote Compliance is a separate business, and if you would rather run the analysis yourself the compliance skills behind it are open source and free to run.
Questions healthtech teams actually ask.
A program the answers describe. The questions presume a current security risk analysis under 45 CFR 164.308(a)(1)(ii)(A), a risk register, a risk management plan, training records and BAA language that survives review. If those do not exist yet, building them is month one of the compliance officer function: the Security Risk Assessment, starting at $3,500. After that the function keeps them current, so the next buyer's questionnaire is a refresh rather than a rebuild.
Often, eventually, and driven by your buyers rather than by regulation. I have carried organizations through both. For a young company an audit is supposed to be the evidence that a program exists, and an auditor tests controls that have to have been running for a period, so a program assembled for the audit window shows. The risk analysis is upstream of either, and the evidence a running program produces is what both audits reuse.
Not at most sizes, not yet. The compliance officer retainer, from $2,500/mo, is the function without the headcount, for under a third of what a hire costs. If you need someone in the building five days a week, hire, and I will help you write the job description.
Yes. The Security Risk Assessment, starting at $3,500, is sold on its own, and its summary letter is written to be handed to a buyer's security team. What it cannot do on its own is stay current, and the next review will ask whether it is.
It changes what is in scope, not what the program is. OCR expects the risk analysis to cover the AI tools in use, vendor AI access, and the shadow AI nobody put on a list, and buyers increasingly ask about it by name. If one AI vendor is the whole reason a deal is stuck, the AI Vendor Analysis is the narrower, faster engagement.
Rote Compliance is the platform I built, and it is a separate business at rotecompliance.com. If you want to run the analysis yourself, the open-source compliance skills are free to read and run against your own documents. The platform itself is the instrument behind my delivery rather than a product sold here. What you buy on this site is me doing it.
Bring me what the buyer sent.
Thirty minutes. Send the questionnaire, the BAA or the audit request, and I'll tell you what it is actually asking for, what you can show today, and what a program would need to show next.