The policy, the workflow, and the checklist for one problem in one sector.
Each toolkit is a working document set, not a reading list. Built from two decades operating privacy, security, and AI governance programs in healthcare and government. Buy the one that matches your gap, or find your gap first.
Three ways to solve this
Regulators, courts, and bar associations publish genuinely useful free material. That is a real option and you should know it exists. Here is the honest comparison.
State agencies, the Judicial Council, HHS, the State Bar, and NIST publish model policies and guidance at no cost. Your team interprets, integrates, and operationalizes them. Real work, real timeline, zero dollars.
An implementation system for one specific problem: the policy plus the workflows, controls, vendor terms, and adoption materials that turn a policy into something a team actually runs. $249 to $1,497.
Fixed-scope, fixed-fee engagements covering program design, operational rollout, workflow and ownership mapping, and staff training. Scope and number confirmed before work starts.
Find the toolkit that matches your gap
Start with your sector. If you are not sure where the highest-priority gap actually is, the assessment under each card scores you in under fifteen minutes and shows you free.
HIPAA Compliance Starter Toolkit
For: compliance teams and general counsel past "we have a BAA" and onto "we've actually reviewed it."
- BAA Review Checklist
- Incident Decision Support Worksheet
- OCR Audit Readiness Assessment
- PHI Data Handling Addendum
K-12 District AI Governance Toolkit
For: superintendents, CTO/CIOs, and boards that need it adoptable, not just downloadable.
- Student-Data & AI Use Policy
- EdTech vendor vetting + risk tiering
- Parent notice & consent (COPPA/PPRA)
- Board-Adoption Kit + § 49073.1 agreement
Higher-Ed GLBA + AI Compliance Kit
For: CISO/CIO, general counsel, and financial-aid and research offices at Title IV institutions.
- GLBA Safeguards Program + breach runbook
- Institutional AI & Data Governance Policy
- AI/EdTech vendor vetting
- IRB / research-data AI governance
Court & Clerk AI Readiness Kit
For: California court executive officers, presiding judges, clerk's offices, and court IT and records teams.
- Court AI Use Policy, built to Rule 10.430
- PII Redaction Protocol (CRC 1.201)
- Records & public access (CRC 2.503)
- Vendor vetting checklist
Solo Attorney AI Compliance Toolkit
For: solos and small firms using AI to draft and research who want written procedures, a verification step, and a training record.
- GenAI Use Policy (fill-in)
- Citation & Output Verification Protocol
- Client disclosure & consent language
- Training materials + 20-question assessment
AI Governance Starter Toolkit
For: organizations rolling out AI across teams with no formal review process and no clear owner when something fails.
- Draft AI Use Policy
- AI Use Case Intake Form
- Risk Tiering Rubric
- Governance Playbook + artifacts checklist
CCPA/CPRA Compliance Toolkit
For: California-facing companies with some privacy infrastructure but no dedicated privacy counsel.
- CPRA Gap Assessment Template
- Consumer Rights Response Playbook
- CCPA/GDPR Crosswalk Reference
- CCPA Compliance Playbook
Incident Readiness Toolkit
For: legal, privacy, security, and operations teams that want the structure in place before an event, not during one.
- Incident Intake & Triage Form
- Severity Classification Matrix
- Breach Assessment Worksheet
- Tabletop exercise + executive briefing
Going deeper on HIPAA
Healthcare is the deepest line. Behind the starter toolkit sit ten individual artifacts that work as one program. Buy the whole thing or just the piece you are missing.
Browse the 10 individual HIPAA tools
What you are buying
Single-organization license
Internal use by the organization named at checkout, including its employees and contractors acting on its behalf. Perpetual. The listed price on every product.
Multi-organization license
Separately operated affiliates, campuses, districts, agencies, or member entities. Priced at 2× to 3× standard depending on the product.
Consultant license
For use across your own client engagements. Negotiated separately. Contact us.
12 months of updates
Every toolkit includes 12 months of updates. Your right to use the version you purchased does not expire. After 12 months, continued updates are available through an optional annual renewal.
Not sure which one you need?
Take the assessment for your sector. You get your score, your readiness level, and your highest-priority gap on screen, free, before anything is asked of you. Then buy the toolkit that closes it, or don't.
Why these and not the free version
Built from operating experience
These come out of two decades running privacy, security, and AI governance programs, including as Assistant General Counsel at Sutter Health and twenty years as an Air Force officer, retiring as a Lieutenant Colonel. The workflows are the ones that held up under real review, not the ones that read well.
Built to a named standard
Each toolkit cites the rule it is built to: 45 C.F.R. Part 164, 16 C.F.R. Part 314, California Rule of Court 10.430, Education Code § 49073.1, the ABA Model Rules. Where a requirement is proposed rather than final, it says so. You can check the work.
Adoptable, not just downloadable
Where adoption is the hard part, the adoption materials are included. The K-12 toolkit ships with a board-adoption kit. The Solo toolkit ships with training and a knowledge assessment. A policy nobody adopted is a draft.
Want it built rather than bought?
JHarris Advisory runs fixed-scope, fixed-fee engagements on the operational side: program design, rollout sequencing, workflow and ownership mapping, vendor process, and staff training. Consulting services, not legal services. The number is confirmed before work starts.