Folder Structure for Regulatory Compliance
Use folders for human orientation and broad access boundaries, but push most compliance logic into metadata and policy engines.
High-Level Pattern (Top 2-3 Levels)
Level 1: Domain
/clinical/- Care delivery policies, protocols, order sets/administrative/- HR, operations, facilities/security-privacy/- HIPAA, GDPR, security policies/billing-revenue/- Coding, billing, collections/research/- IRB, study procedures/risk/- Risk management, AML, KYC/trading/- Trading procedures, disclosures/finance/- Financial reporting, products
Level 2: Jurisdiction
/us/- United States/eu/- European Union/uk/- United Kingdom/br/- Brazil/multi-jurisdiction/- Cross-border
Level 3: Document Type
/policy/- High-level policies/procedure/- Detailed procedures/sop/- Standard operating procedures/work-instruction/- Step-by-step instructions/form/- Forms and templates/guideline/- Best practice guidelines
Usage Examples
# Basic usage
/command-name
# With options
/command-name --option value
# Advanced usage
/command-name path/to/target --recursive --verbose
Invocation
/command-name [arguments] [options]
Separate Working vs Controlled Content
| Folder | Purpose |
|---|---|
/draft/ | Authoring and review |
/controlled/ | Approved/official |
/archive/ | Obsolete/superseded |
Example Paths
clinical/us/policy/hipaa-privacy-officer.md
risk/eu/procedure/aml-kyc-review.md
trading/us/policy/sec-17a4-electronic-records.md
Naming Conventions
Include IDs and versions in filenames:
DOC-CLN-001-hipaa-privacy-v3.2.md
DOC-SEC-015-breach-notification-v2.1.md
DOC-FIN-003-trading-records-v1.0.md
Format: DOC-{DOMAIN}-{NUMBER}-{slug}-v{major}.{minor}.md
Automation Requirements
Use RPA/agents to normalize:
- Folder placement
- Filenames on ingest
- Metadata extraction
Key Principle
Folders provide human-readable organization. The authoritative compliance data lives in metadata and retention tables.