When a rule changes, your documents don't.
A final rule lands. The trade press covers it for a week. Two years later most organizations in the segment still have a posted notice describing the old regime, because nobody owned the job of noticing. These are the fixed-scope engagements for exactly that gap: one regulation at a time, priced up front, credit forward.
Each one is a single rule, a fixed scope, and a fee that credits forward.
42 CFR Part 2 Alignment
The 2024 final rule changed how consent, redisclosure and notice have to work for substance use disorder records. Alignment walks the ten areas it touched against the program's own consent forms, policies, procedures and QSO agreements, not the notice alone.
Alignment Review: $750, and the fee credits 100% forward.
HIPAA Security Rule
The risk analysis 45 CFR 164.308(a)(1)(ii)(A) requires: a standing obligation rather than a rule change. The proposed Security Rule overhaul would make it a change, and the organizations that will absorb it without disruption are the ones whose analysis is current when it lands.
Security Risk Assessment: starting at $3,500.
My Health My Data
Washington's consumer health data act, RCW 19.373, reaches data HIPAA does not and carries a private right of action. A program built to the federal floor can be complete on its own terms and still leave that reach uncovered. Covered inside the assessment today rather than sold as its own program.
Covered in the assessment today. Standalone program in development.
AI Use Policy and Governance
The tools are already in the building and the policy governing them usually is not. Today this is scoped as an AI governance engagement; the packaged, fixed-scope version is the next wedge.
Available now as a scoped AI governance engagement.
Every one of these works the same way.
Start with the rule you are facing.
If it is on this page, there is a fixed price and a delivery window. If it is not, tell me anyway. New programs get built because someone asked.