A method you can read
before you trust it
Most compliance vendors keep the methodology inside the product, so the only way to check the work is to buy it. Rote publishes the method instead: 13 Apache 2.0 skills that encode what to check, which provision to check it against, and what the analysis refuses to conclude. Research tests the claims the method makes. The platform runs it behind a practice. This page is what the method is and how the pieces fit.
What the method decides.
What only you can.
The method is built on language models, and the reason to publish it rather than hide it is that the boundary between what the analysis settles and what it cannot settle is the part worth auditing. A skill reads documents against a named provision and reports what it found, what is missing, and the citation behind each. It does not decide whether a gap matters to the business.
That line is drawn deliberately. Every skill is written to say what it could not conclude from what it was given, rather than filling the space with a plausible answer. A finding you cannot trace back to a document and a provision is not a finding.
Mechanical reading at a scale and consistency a person cannot sustain.
- Whether a required clause or safeguard appears in the documents
- Which provision each finding maps to, cited to the section
- Where two documents or frameworks disagree
- What it could not determine from what it was given
Judgment the analysis has no standing to exercise, and never claims to.
- Whether a gap is worth closing, and in what order
- Which risks the organization accepts
- How the rule applies to facts no document records
- The decisions a regulator holds the organization to
Analysis and regulatory watch.
Two categories, one platform.
What follows describes the software rather than the published skills. The skills are the part a reader runs: open them, change them, point them at their own documents. The platform is the instrument behind the practice that uses it, it is not open for signups, and access is arranged inside an engagement. The architecture is worth stating anyway, because it is what the method looks like when it runs against a whole workspace at once.
The platform is built around two categories of capability, and they are deliberately sequential. The baseline exists as the foundation that gives a regulatory change something to be matched against.
Point-in-time analysis shows where an organization stands. Six baseline workflows cover the full compliance surface: HIPAA gap analysis, BAA review against 45 CFR 164.504, bidirectional framework mapping with confidence scoring, control assessment with evidence extraction, 3x3 risk assessment, and RAG-backed compliance Q&A.
The regulatory watch shows when the ground shifts. It reads HHS and CMS documents as the Federal Register publishes them and matches each one against the CFR citations the workspace's own manual sections already carry. That surface area is meaningful because the baseline analysis defines it: a rule change is reported against the section that cites it, or reported as awareness if it touches nothing. That is the dependency, and it is why the two are built in this order.
Most compliance platforms stop at point-in-time analysis. Rote treats it as the floor.
Monitoring without a baseline watches for drift from nowhere. The baseline defines the surface area, so the order is a quality constraint, not a sequence of upsells.
Six point-in-time workflows, run on command against the documents in a workspace. Every finding is citation-backed and grounded in the specific CFR or framework it addresses.
- → HIPAA Gap Analysis
- → BAA Review (45 CFR 164.504)
- → Framework Mapping
- → Control Assessment
- → Risk Assessment
- → Compliance Q&A (RAG)
The ingest and matching layer. Requires baseline analysis to be meaningful: the baseline is what gives an incoming rule change something to match against.
- → Federal Register ingest (HHS, CMS)
- → CFR citation matching to manual sections
- → Affecting vs. awareness classification
- → Digest of what moved
Four steps, and the order is the point.
The method runs as a loop, and the steps go in a fixed order. It starts with the free Self-Check, which places an organization on the compliance maturity matrix and says which stage applies. Each step after that depends on the one before it.
The order is a quality constraint, not an upsell mechanic. Monitoring without a documented baseline watches for drift from nowhere, and a remediation roadmap is only useful once the analysis has mapped the gaps it is acting on. Nothing here is gated; the sequence is just what makes each step produce something worth having.
The Self-Check places an organization on this five-dimension matrix. The shaded shape is the posture Rote most often sees at first contact: low awareness, with ad-hoc training and monitoring. It illustrates a common starting point, not a measured benchmark.
A fleet of agents.
A library of approved skills.
On the platform, Rote runs a set of agents on command over the same library of skills a reader can download and run one at a time. Which agents run, and which skills they use, depends on what the business needs to demonstrate and to the stakeholder asking. As the questions change, the same library answers them differently. Nothing in the fleet runs on a schedule except the regulatory watch.
Each skill is a structured workflow grounded in a specific regulation or framework, not a general-purpose prompt. The fleet grows and changes as the work does; the diagram stays the same because the relationship does.
One practitioner wrote all of it
The method is one person's practice, written down: a healthcare compliance lawyer who built the skills out of his own caseload. In his words:
I built Rote because I am often called on to be the practitioner doing the manual review, and I decided to build something to help me. Every workflow maps to work I have actually done. The BAA Review workflow was not built by teaching the model what 45 CFR 164.504 says. The model already knows that. It was built by encoding which provisions actually kill deals, which gaps show up in startup BAAs consistently, and what a finding needs to say so the client can act on it without a follow-up call.
I am Dan Gonzalez. JD with a Health Law Certificate. I built healthcare compliance programs at regulated technology companies: HITRUST audits, SOC certifications, CMS authorization, BAA review at scale, fractional CCO work across healthtech, managed care, and provider organizations.
The compliance work I do every day needed a platform behind it that could actually do the analysis. That is why Rote exists. The baseline workflows came first because the regulatory monitoring layer depends on that grounding to be specific and actionable. The methodology behind every workflow comes from active compliance program building, not from market research or AI-generated templates.
If you want to talk about the skills or the methodology behind any of this, reach out. The full background on who I am outside of Rote is at dangssolutions.com.
Dan Gonzalez, JD · dangssolutions.com
Who uses this,
and how
Rote is used by organizations that handle protected health information and are putting AI to work, where a compliance gap is a regulatory exposure rather than a hypothetical. There are two ways in, depending on whether you want to run the method or have it run.
Every skill is published under Apache 2.0 and free to read. Run them in your own environment, against your own documents, on whatever model you already use. Change what does not fit before you trust it with a client's files.
Browse the library Dan runs it· inside an engagementThe same skills, run by a set of agents against a configured workspace instead of one document at a time. It is the instrument behind the practice rather than a product sold here, it is not open for signups, and access is arranged inside an engagement.
How it worksRead it before
you trust it.
The method is open source. Run a Self-Check against your own documents, or read any skill's source. The platform that runs them is the instrument behind the practice, not a product on offer here.
Need this done rather than explained? Dan Gonzalez runs Dang's Solutions, the practice that delivers it.