Both rules do. A security official (45 CFR 164.308(a)(2)) and a privacy official (45 CFR 164.530(a)), both Required. And then neither rule says a word about what that person actually does on a Tuesday. So here is the job, published in full.
Your people are thinking about authorizations, staffing tomorrow's session, and whether the payer paid. That is a clinic running correctly. Which means your clinic's reality never enters a compliance system on its own.
Nobody files a note that an RBT is collecting data on a personal phone, or that a stack of data sheets has been in someone's trunk since Tuesday. Those things happened because they solved a problem, and the compliance consequence never crossed anyone's mind.
A compliance system that waits to be told the truth will be confidently, provably wrong about your clinic, with a timestamp on it. A stale record that looks current is worse than no record. It is a lie with an audit trail.
That is the whole reason the officer exists. Not as a service wrapped around software. The officer is how reality gets into the system, because there is no other path and there never was.
Not reduces. Removes. This is the clause that turns a weekly conversation from administrative hygiene into an instrument with a number attached, and almost nobody in this market mentions it, because almost nobody knows it is there.
An affirmative defense, written into the regulation. Something goes wrong in every clinic eventually. If it surfaces on Tuesday and closes inside thirty days, the rule itself takes the penalty away. If nobody asks, it surfaces two years later inside a breach investigation, where it is not a correction. It is a finding.
The cadence below is a machine for finding things while that window is still open. How it plays out in an OCR investigation →
Turnover moves weekly. Systems drift monthly. The gap between paper and practice shows quarterly. Whether the model still matches the clinic is an annual question. And some things start a legal clock the moment they happen.
An employee files a compliance report. Two weeks later a supervisor writes them up for something unrelated, and the write-up is probably fair. But the person approving it never knew a report was on file, and now the clinic has disciplined someone right after they did a protected thing, with nothing on paper showing the two were weighed separately. That is retaliation by accident, and to an investigator, "we did not know" is a weak answer.
The platform checks whether the person being disciplined has a report on file, and if so, it surfaces a single caution before anything is signed: document your non-retaliatory reasons first. It answers yes or no and nothing else. No date, no category, no link to the report, because a caution detailed enough to identify the reporter would be the very thing it is meant to prevent.
The officer is who acts on it. The prompt is only useful if someone with the authority to slow a write-up down is actually watching, reads it, and makes the call document, defer, or proceed with reasons recorded. That is the job, and it is the difference between a defensible decision and an accidental finding. How the reporting channel and the retaliation check actually work →
The rule does not require a credential, a certification, or an outside firm. It requires a named human with the authority to actually do something, and a record that they did it. That person can absolutely be you.
Every week, in plain words, of people who are not thinking about compliance and should not have to be. That is the job. If you want it done and you do not want to do it, that is what we are for.