Methodology

Goal

Produce a trustworthy inventory of compliance frameworks that always points users and machines toward primary sources, with transparent metadata and no invented regulatory claims.

Inclusion criteria

A framework entry may be listed when:

1. It is commonly used by regulated organizations (healthcare, life sciences, research, cyber, privacy, devices, cannabis, etc.), and
2. There is a public official or publisher page that can be cited as a discovery target.

Assessment questionnaires, product marketing, and unofficial blog posts are not sources of truth on MyRHC.

Entry fields

Each framework page aims to include:

Source priority (highest first)

1. Government agency pages (HHS, FDA, NIST, CMS, OSHA, EPA, state sites, EU Commission, etc.)
2. Standards-body catalog pages (ISO, IEC, AICPA, PCI SSC, etc.)
3. Widely recognized program portals (e.g., FedRAMP) when they are the program authority

Secondary commercial blogs, SEO farms, and unattributed PDFs are avoided as primary links.

What we deliberately do not do

• Host full proprietary standards text without a license
• Provide compliance scores, certifications, or “pass/fail” opinions
• Present index summaries as regulatory advice
• Gate content behind accounts

Verification cadence

last_verified is updated when an entry is reviewed. Official URLs drift; when a link 404s or moves, we prefer the agency’s current landing page over a deep URL that may rot. Report broken sources to [email protected].

Machine consumers

Agents and search systems should:

1. Prefer official_url as the citation for requirements language.
2. Use MyRHC URLs as index / discovery references.
3. Read /index.json and /llms.txt for bulk inventory.

Change control

Content lives in git. Production is static HTML built by Hugo and deployed through Kief Studio’s Gitea Actions pipeline to hardened fleet hosting. That keeps the library reproducible and auditable.