When a rule changes, your documents don't.
A final rule lands. The trade press covers it for a week. Two years later most organizations in the segment still have a posted notice describing the old regime, because nobody owned the job of noticing. That job is the compliance officer function, and the rule that moved becomes its first month of work.
Each one is a rule that moved, and the compliance officer function is what notices.
42 CFR Part 2 Alignment
The 2024 final rule changed how consent, redisclosure and notice have to work for substance use disorder records. Alignment walks the ten areas it touched against the program's own consent forms, policies, procedures and QSO agreements, not the notice alone.
Month one for a Part 2 program whose risk analysis is current. The Alignment Review is also sold on its own.
HIPAA Security Rule
The risk analysis 45 CFR 164.308(a)(1)(ii)(A) requires: a standing obligation rather than a rule change. The proposed Security Rule overhaul would make it a change, and the organizations that will absorb it without disruption are the ones whose analysis is current when it lands.
Month one for an organization without a current analysis, and also sold on its own.
My Health My Data
Washington's consumer health data act, RCW 19.373, reaches data HIPAA does not and carries a private right of action. A program built to the federal floor can be complete on its own terms and still leave that reach uncovered.
Read inside the risk analysis today.
AI Use Policy and Governance
The tools are already in the building and the policy governing them usually is not. Bounded AI work around a program that already runs is a project in the queue; building the AI program itself is its own retainer.
A project inside the function, or the AI Enablement Retainer.
The rule watch is standing work.
Inside the compliance officer function, watching the rules that govern your organization is part of the calendar, not a project somebody remembers to start. When one moves, I read it against your own documents: what the notice, the consent forms and the policies say, against what the rule now requires, with a citation for every gap. The documents that are out of date become work in your queue.
Month one goes to whichever required artifact is missing. Month one is the risk analysis, billed at the assessment price. If your analysis is current and you run a Part 2 program, month one usually goes to Part 2 instead. The function starts at $2,500/mo.
Before any of that, the free Self-Checks run in your browser, and the open-source skills behind the reading are on rotecompliance.com. Some organizations stop there, correctly.
Start with the rule you are facing.
Thirty minutes, no charge. Tell me which rule moved, or which one you are not sure about, and I'll tell you what it means for your documents and whether it is something I can help with. If it is not on this page, tell me anyway.