Digital health, RCM, health-tech & HIPAA business associates

Research {{company}}, a US health-tech vendor, and produce a HIPAA readiness brief.

Inputs:
- Website: {{website}}
- Known customer segment: {{buyer_segment}} (e.g. hospitals, payers, FQHCs, telehealth direct-to-consumer + B2B2C)

Find from public sources:

1. HIPAA scope
   - Are they a Business Associate, a Covered Entity, both, or neither? Justify.
   - Do they process, store, or transmit PHI?
   - Subprocessors that touch PHI (analytics, comms, support, AI vendors).

2. Existing trust posture
   - /trust, /security, /legal pages. Do they list HIPAA, SOC 2 Type II, HITRUST?
   - Public BAA availability statement?
   - Any breach disclosures in HHS OCR Breach Portal (search by company name).

3. Customer signals
   - Hospital / health-system / payer logos on the site.
   - Case studies in regulated health verticals.

4. Security org
   - Privacy Officer, Security Officer, CISO present?
   - Recent hires in compliance / privacy / security in last 6 months.

5. NPRM readiness
   - Public mention of MFA enforcement, encryption-at-rest, network segmentation, 72-hour restoration drills.

6. Trigger surface
   - Funding rounds, new health-system contracts, exec hires.
   - Adjacent breach disclosures in their segment.

7. Outreach hook
   - One sentence connecting a specific trigger to a 45 CFR 164.308 risk analysis.

Return as markdown with section headers and source URLs.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Build a list of 25 US digital health, RCM, or health-tech B2B vendors that are likely overdue for a HIPAA risk analysis.

Filters:
- US HQ
- Sells to hospitals, payers, IDNs, ACOs, FQHCs, or other BAs
- Headcount 20–500
- Funding: Seed-extended through Series C in the last 36 months
- Public /trust or /security page does NOT mention HITRUST r2 / Validated
- AT LEAST one trigger:
   - Posted Privacy Officer, Security Officer, or HIPAA Compliance role in last 6 months
   - Announced a new hospital / payer customer in last 12 months
   - Mentioned in HHS OCR Breach Portal in last 36 months (theirs OR a top-5 subprocessor)
   - Funding round in last 12 months

Return as a table:
| Company | Customer type | Headcount | Funding stage | Existing public HIPAA posture | Recent privacy/security hire? | Breach signal? | Likely buyer (CTO/CISO/Privacy Officer) LinkedIn | Best opening hook |

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Write a 3-touch outbound sequence to {{first_name}} ({{title}} at {{company}}).

Context:
- {{company}} is a health-tech BA selling into {{buyer_segment}}.
- Trigger: {{trigger_event}} (e.g. "won a 5-hospital pilot," "competitor breach disclosed last week," "hired first Privacy Officer").
- They likely have an outdated risk analysis.
- Sender: {{partner_name}}, {{partner_company}}.

Constraints:
- Touch 1: ≤110 words. Lead with the trigger. Bridge to "the BAA conversation that asks for the risk analysis." Soft CTA = reply or {{affiliate_link}}.
- Touch 2 (day 4): ≤80 words. Reference the OCR pattern (first request in every investigation is the risk analysis under 45 CFR 164.308(a)(1)).
- Touch 3 (day 9): ≤45 words. Break-up.
- No "I hope this finds you well." No "circling back."
- CTA: {{affiliate_link}} — self-service readiness, not a sales call.

Return three labeled blocks with SUBJECT + BODY.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Draft a 4-step LinkedIn cadence to {{first_name}} ({{title}} at {{company}}).

1. Connection note (≤300 chars). Reference a specific public artifact (a post, a hospital customer announcement, a panel they spoke on). No pitch.
2. Day-2 DM (≤500 chars): one specific observation about the NPRM or a recent OCR settlement in their segment + one open question.
3. Day-6 DM (≤300 chars): share {{affiliate_link}} framed as "a 90-minute readiness pass against the current Security Rule + NPRM proposed updates."
4. Day-13 DM (≤200 chars): polite break-up.

Voice: peer privacy/security leader. Cite 45 CFR Part 164 sections naturally. Avoid jargon like "synergies" or "leverage."

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Build a 25-minute discovery call script for {{first_name}} ({{title}} at {{company}}).

Sections:
1. Open (90 sec): confirm time, restate hypothesis ("you're being asked for a current risk analysis in BAA reviews and your last one is stale"), get permission for 6 questions.
2. Six qualifying questions:
   - When was your last documented HIPAA risk analysis and who performed it?
   - How many open BAAs are sitting in your sales pipeline today?
   - Have any of your hospital or payer customers asked for HITRUST in the last 12 months?
   - Which subprocessors handle PHI today, and do you have current BAAs with all of them?
   - Are you tracking the Security Rule NPRM (encryption, MFA, segmentation, 72-hour restoration)?
   - What's your incident-response posture — when was the last tabletop?
3. Bridge (3 min): map answers to the self-service HIPAA readiness assessment.
4. Close: working session OR {{affiliate_link}}.

Branching: if they're a Covered Entity, not a BA, adjust language toward Privacy Rule + Notice of Privacy Practices.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

You are a HIPAA privacy + security consultant responding to {{first_name}} ({{title}} at {{company}}).

They said:

"{{objection}}"

Reply in 3–5 sentences. Rules:
- Mirror their language first.
- Cite 45 CFR Part 160 or Part 164 by section when relevant (e.g. 164.308(a)(1) risk analysis, 164.312(a)(1) access control, 164.404 breach notification).
- Reference the December 2024 HIPAA Security Rule NPRM where it applies.
- End with a forward-moving question, not a pitch.
- Never sound defensive. Never say "actually."

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.