What it produces

A gap list you can act on

A prioritized, org-specific gap list across the ten Part 2 areas — not a generic checklist, your documents against the rule.
Every finding tagged by enforcement exposure, so you fix the publicly visible gaps before the internal ones.
Ratified by a compliance attorney — a person stands behind each finding, not just a model.
A short, plain remediation order: what to correct first, and why that order.

How findings are prioritized

Tagged by enforcement exposure

Not every gap carries the same risk. Each finding is tagged so you can triage by exposure, not by guesswork.

Publicly visible

In a notice anyone can read on your website or in your lobby. The highest-exposure gaps, because they're discoverable without a complaint.

Complaint-triggerable

Surfaces when a patient or regulator looks — a missing right, an element a complaint would expose.

Internal-only

Real, but not externally visible without an audit. Fixed after the exposed gaps are closed.

What this is — and isn't

This assesses what a program's posted documents say against what the 2024 rule requires — never an assertion about how the program handles records.

No PHI. The Review reads templates and posted notices only, never patient records. Nothing about a patient enters the engagement.

See where you stand before you pay anything. The Self-Check runs in your environment; the Review picks up from there and credits 100% forward.