01Purpose
Early decisions about regulatory intent, architecture, data and security are the most expensive to reverse later. This audit gives founders, boards and innovation leads an independent, evidence-based view of where the product stands, which risks matter most, and what to do about them, in order, before committing further capital to build.
Typical triggers: preparing to raise, preparing for an enterprise, health-system or pharma partner review, deciding whether a product is Software as a Medical Device, taking over an inherited codebase, or planning the first technical hire.
02Scope of review
One product or platform, reviewed across seven readiness domains:
| Domain | What we assess |
|---|---|
| Regulatory & product intent | Intended use and claims, likely SaMD / device classification, applicable pathway, and whether the product roadmap is consistent with that position. |
| Architecture & platform | System design, hosting, scalability, auditability, versioning and data provenance; decisions that will be expensive to reverse. |
| Data & interoperability | Data sources and flows, identity and consent, FHIR / EHR integration approach, data model fitness for downstream analysis. |
| Evidence, endpoints & measurement | Whether collected data can support the clinical, scientific or commercial claims being made; validity of digital endpoints and analytic pipelines. |
| Security, privacy & compliance | HIPAA posture, access control, encryption, logging, vendor/BAA coverage, and readiness for SOC 2 or customer security review. |
| Quality, risk & lifecycle | Design controls, risk management, change control, testing and release practices, right-sized to the product's stage and classification. |
| Team, delivery & handoff | Ownership, engineering practices, vendor dependencies, key-person risk, and hiring priorities. |
Methods
- Review of existing documentation, architecture diagrams and regulatory materials
- Up to 6 structured interviews with leadership, engineering and clinical/scientific staff
- Read-only review of source repositories, cloud configuration and CI/CD
- Walkthrough of the product and its data flows
Out of scope
- Penetration testing or formal security certification
- Legal opinions or regulatory submissions
- Writing or fixing production code
- Additional products or platforms (scoped separately)
03Deliverables
| ID | Deliverable | Description | Due |
|---|---|---|---|
| D1 | Audit plan | Confirmed scope, interview schedule, access list and document request. | Week 1, day 2 |
| D2 | Findings report | Written report covering all seven domains. Each finding is rated by severity (critical / high / medium / low) with the evidence behind it and a recommended action. | End of week 3 |
| D3 | Remediation roadmap | Findings sequenced into 30 / 60 / 90-day actions, with effort estimates and suggested owners. | End of week 3 |
| D4 | Executive summary | Two-page summary suitable for a board, investor or partner audience. | End of week 3 |
| D5 | Leadership readout | 90-minute session walking through findings and roadmap, with Q&A. | Week 3 |
| D6 | Follow-up support | 30 days of email follow-up and one 60-minute check-in to support execution. | 30 days after D5 |
04Timeline
- Week 0 · IntakeSignature and first payment; access granted; document request fulfilled; interviews scheduled.
- Week 1 · DiscoveryKickoff, audit plan (D1), documentation and codebase review, first round of interviews.
- Week 2 · AnalysisRemaining interviews, deep dives on highest-risk areas, findings drafted and rated.
- Week 3 · Report & readoutFindings report, roadmap and executive summary delivered (D2–D4); leadership readout (D5).
The timeline assumes access and interviews are available as scheduled. Delays on the client side extend delivery day-for-day.
05Fees & payment
| Item | Terms | Amount |
|---|---|---|
| Initial Audit (D1–D6) | Fixed fee, one product or platform | $15,000 |
| Payment 1 | 50% due on signature | $7,500 |
| Payment 2 | 50% due on delivery of D2–D4 | $7,500 |
| Total | $15,000 |
Optional add-ons
| Add-on | Description | Fee |
|---|---|---|
| Expedited delivery | Completed in 2 weeks instead of 3. | +$3,500 |
| Investor / diligence memo | Findings written up for a named investor or partner, plus one call with them. | +$2,500 |
| Additional product | A second product or platform reviewed in the same engagement. | Quoted |
Invoices are payable within 15 days. Pre-approved travel is billed at cost. If you sign an Advisory or Fractional CTO engagement within 60 days of the readout, 50% of the audit fee is credited against it.
06Client responsibilities
- A named point of contact, with authority to schedule interviews and resolve access requests
- Read-only access to source repositories, cloud consoles, ticketing and documentation within 3 business days of kickoff
- Interview availability for up to 6 people, 45–60 minutes each, during weeks 1–2
- Existing materials, such as architecture diagrams, regulatory correspondence, policies, vendor agreements and product roadmap, as available
07Terms
- Confidentiality. Both parties keep each other's non-public information confidential. We will sign your mutual NDA or provide ours.
- Data handling. We work from read-only access and do not need production patient data. If PHI exposure is unavoidable, we will execute a Business Associate Agreement first.
- Ownership. On full payment, the client owns all deliverables. Palo Alto Health Labs keeps its general methods, templates and know-how.
- Acceptance. Deliverables are accepted on delivery unless the client identifies a material gap against this SOW within 5 business days; we will address it at no additional cost.
- Changes. Changes to scope are agreed in writing before work begins, with any fee or timeline impact stated.
- Cancellation. Either party may cancel with written notice. Fees for work completed to that date are due; the first payment is non-refundable once discovery has started.
- Nature of advice. Findings are technical and strategic assessments. They are not legal advice or a regulatory determination, and they do not guarantee a regulatory or commercial outcome.
08Acceptance
Signing below authorizes the work described in this Statement of Work at the fees stated.
Ready to start?
Reply to confirm, and we'll send a countersignable copy and schedule kickoff. Questions about scope or fit are welcome first.
Confirm or ask a question