Compliance Posture Intake

Purpose

Guide a non-technical user through a structured compliance posture assessment. Combine their self-reported answers with analysis of any compliance documents they share. Deliver a polished Word document they can share with their team, bring to a consultation, or use to seed a Rote account.

This skill runs all analysis inline by default. Do not rely on external tool invocations unless they are available in your agent context.

Note for Agent Contexts: This skill runs all analysis inline by default. However, if you are running in an agent context (like Claude Code, Rote MCP, or a custom agent) with access to the rote-compliance-toolkit tools, you may optionally chain those tools for document analysis (Step 3) instead of doing it inline.

The analytical methodology for each document type is embedded in Step 3 below.

How to Run This Skill

Work conversationally. Do not present the full question list upfront. Lead the user through the assessment as a structured conversation — each step flows naturally from the last.

Before beginning, say:

"I'll guide you through a compliance posture assessment. It takes about 15 minutes and covers your policies, training, oversight structure, risk management, and incident response. At the end, I'll produce a report you can share with your team or bring to a consultation.

Let's start with some context about your organization."

Step 1 — Orientation

Ask Group A and Group B as two separate conversational exchanges. Do not number the questions aloud — ask them naturally as a grouped set.

Group A — Organizational context

Ask all eight together in a single message, formatted as a brief list:

"A few quick questions to set the context:

• Briefly describe what your product or service does — what problem it solves and what types of data or workflows it touches. (A sentence or two is fine.)
• What is your organization's role under HIPAA — are you a Covered Entity, a Business Associate, or both? (If you're not sure, just say so.)
• Roughly how many employees handle patient data, directly or indirectly?
• What stage is your company at? (Pre-revenue, early growth Series A/B, established Series B+, or enterprise)
• Who is your primary healthcare customer? (Small practices, mid-market health systems, enterprise health systems, payers, or multiple)
• Which compliance frameworks are you expected to meet? (HIPAA is the baseline — are HITRUST, SOC 2, NIST, or ISO 27001 also on the table?)
• What's your main goal with this assessment today?
• Do you have any compliance documents you'd like me to analyze? (Policies, a BAA, a risk assessment, training records, or a state license or business registration — any combination is fine.)"

Group B — Risk profile

After receiving Group A answers, ask Group B as a brief follow-up: