Practitioner-led healthcare compliance, priced up front.
Start with the Security Risk Assessment the rule requires: fixed scope, published price, delivered in days. A free Snapshot tells you where you stand.
Start here · the foundation
The assessment the rule requires.
Every covered entity and business associate must conduct the security risk analysis under 45 CFR 164.308 — the most-cited deficiency in OCR investigations and the artifact MIPS reporters attest to each year. Rote delivers it fixed-scope, priced up front: starting at $3,500, 10 business days, every finding evidence-cited, attestation-ready.
Free / Self-Check
See where you stand
Run the open-source skills yourself, or take the free Snapshot for a maturity read and a routing recommendation.
Starting at $3,500 / Security Risk Assessment
The analysis the rule requires
Asset and ePHI inventory (AI surface included), threats scored, risk register, risk management plan, attestation-ready letter. 10 business days.
Starting at $8k / Risk Management Project
Close the gaps — AI included
Implements the plan: corrected policies, safeguard docs, BAA language, and AI-specific work where findings warrant it. Already have a risk analysis from someone else? Bring it.
Starting at $750/mo / Maintenance
Keep it current
Annual SRA refresh (MIPS requires a fresh analysis each year), quarterly reviews, SAFER Guide, Security Rule watch.
Already have AI questions?
When you need more than the assessment.
Three specific AI situations come up beyond the assessment itself. Each has one clear door — no separate AI ladder to climb.
Close a gap · starting at $8k
A risk analysis found AI gaps
The Risk Management Project builds the AI-specific fix: use policy, governance charter, vendor-review process. Built on your findings — and you can bring a risk analysis you had done elsewhere.
See the Risk Management Project →On-demand · starting at $5k · 5 days
One vendor holding up a deal
AI Vendor Analysis: a credible, documented risk verdict on a single AI vendor — Compliant / Conditional / Non-Compliant — in five business days, without a full posture review.
Unstick a stuck deal →Scoped engagement
AI is central to what you build
Healthtech shipping models, or an institution standing up a program: a full AI governance build — policies, charter, board reporting, ongoing monitoring. Scoped to your organization; start with a conversation.
Talk about an engagement →Compliance Agents
A growing team of agents, on a growing library of skills.
The platform runs a team of compliance agents on top of the same skills the rest of Rote uses. They keep your program current between engagements: each runs on its own cadence, hands its findings to the next, and pauses for your review before anything changes.
The team is not a fixed set. New agents and new skills join as the regulations and the work change, the same way Rote's skill library grows. A few of the agents running today:
Gap Closure
Watches the findings from your last analysis, groups the ones that have not moved, and writes a specific next action for each. One nudge per theme.
Regulatory Watch
Reads the week's regulatory events from Sentinel, filters to what is relevant for your framework and org type, and says plainly whether a response is required.
Document Health
Tracks every document against its review cadence and flags what has fallen behind, so nothing quietly goes stale between reviews.
More as the work grows
The fleet expands with the regulations it covers and the skills it can draw on. The relationship stays the same. The roster does not.
Proof It Works
The method is already in the field.
The skills behind the agents and the engagements are open source, and practitioners are running them on their own documents, not because they came bundled in something else.
1,500+
installs of the Risk Assessment skill on ClawHub: compliance practitioners running the Rote methodology in their own Claude environments.
The Rote compliance skills are open source and available on ClawHub. Practitioners download them, run them against their own documents, and use the output to drive their compliance programs. The skills have crossed 9,000 downloads, from compliance professionals who chose this framework specifically, not because it came bundled in something else.
Explore the open-source skills →Sample Output
This is what a Snapshot looks like.
The Snapshot applies the Rote compliance methodology to your organization's current situation and delivers a structured maturity assessment. What you get back is a maturity stage, a service recommendation, and a 30/60/90-day roadmap.
Representative example. Client details redacted. Your Snapshot reflects your organization's actual documents and posture.
Regulatory Programs
When a single regulation needs working end to end.
Some rules deserve a program of their own. The method is already mapped to each of these in Rote's regulatory knowledge base — a new regulation becomes a new program without changing how any of it works. Part 2 has its own page today; the rest run as scoped engagements.
42 CFR Part 2 · Live
Part 2 Alignment
SUD & behavioral health. The 2024 final rule changed what your posted patient notice must say. Free Self-Check, then a fixed-price Alignment Review.
See Part 2 Alignment →42 CFR 482–484, 418 · Mapped
Conditions of Participation
The CMS CoP for hospitals, home health, hospice, and long-term care. Your program read against the CoP that governs your setting. Home health is an active focus.
Scope an engagement →AKS · Stark · FCA · OIG · Mapped
Fraud & Abuse
The federal fraud-and-abuse regime: Anti-Kickback (42 USC 1320a-7b), Stark self-referral (1395nn), the False Claims Act, and OIG civil monetary penalties & exclusions. Arrangements and policies read against all of it.
Scope an engagement →State rules · Mapped
Peer Supervision
Peer recovery support. State-by-state rules for clinical supervision of peer support workers: supervisor qualifications, training, and documentation, aligned to the state you operate in.
Scope an engagement →More as the work grows
Next wedges
New regulations are mapped into the knowledge base as the work demands, and each becomes a program the same way. The roster grows; the method does not change.
Research
Reading the field against the rule.
Rote publishes rolling, aggregate studies of publicly posted compliance artifacts, read against the regulation that governs them. The first reads posted 42 CFR Part 2 patient notices against the 2024 final rule. Findings are reported in aggregate, no organization is named, and the assessment is reproducible through an open skill.
See the research →Writing
Recent writing
Analysis on HIPAA compliance, healthcare regulation, and the intersection of AI and regulated industries.
First Step
Know your gaps before
your next audit.
The Snapshot is free. The Rote methodology is applied to your organization's actual situation and delivered as a maturity stage, a priority finding, and a 30/60/90-day roadmap, all within one week.