The Compliance Landscape: 26 Years of Change

Send us Fan MailThe compliance landscape has changed more in the last 26 years than most leaders want to admit and somehow the basics still win. We connect the dots between real-world HIPAA enforcement and what actually holds up when something goes wrong: evidence. Not a binder. Not a trust center page. Proof that you know your systems, control access, manage vendors, and can recover fast.We start with the HIPAA Security Rule and why its administrative, physical, and technical safeguards still define the floor for protecting ePHI. Then we unpack the 2013 Omnibus Rule and the moment business associates stop being “adjacent” to HIPAA and become directly accountable. We clarify covered entity vs business associate, why incidental contact still counts, and how to use business associate agreements the right way without stuffing them full of unrelated cybersecurity obligations.From there we look forward to HHS’s proposed HIPAA Security Rule rewrite and the themes leaders should already be planning around: multi-factor authentication, encryption, asset inventories, network maps and data flows, vulnerability scanning, penetration testing, stronger recovery expectations, and heavier documentation. To make it real, we pull up the HIPAA Wall of Shame and talk through the patterns that keep showing up: hacking, email compromise, and exposed servers impacting organizations of every size.We close with what to do now: name an owner, build a repeatable rhythm, tighten access control and third party oversight, add AI guardrails to policies, and test backups and incident response until you can prove it works. Subscribe for updates on what HHS announces next, share this with the person who owns compliance at your company, and leave a review with your biggest HIPAA challenge so we can tackle it next.Thank You for Listening to the VRC Podcast!Visit us at VanRein ComplianceYou can Book a 15min Call with a GuideFollow us on LinkedInFollow us on XFollow us on Facebook