A gap list you can act on

Tagged by enforcement exposure

Not every gap carries the same risk. Each finding is tagged so you can triage by exposure, not by guesswork.

Publicly visible
In a notice anyone can read on your website or in your lobby. The highest-exposure gaps, because they're discoverable without a complaint.
Complaint-triggerable
Surfaces when a patient or regulator looks: a missing right, an element a complaint would expose.
Internal-only
Real, but not externally visible without an audit. Fixed after the exposed gaps are closed.
This assesses what a program's posted documents say against what the 2024 rule requires, never an assertion about how the program handles records.
No PHI. The Review reads templates and posted notices only, never patient records. Nothing about a patient enters the engagement.

Who keeps it current

A gap list is only worth something once someone owns it. For a Part 2 program without a compliance officer, this read is the first month of that function, and the gaps it finds become the work that follows. If you want to see where you stand first, the free Self-Check runs in your environment.

The compliance officer function Get the Self-Check