Advertise on podcast: VanRein Compliance Podcast

Send us Fan Mail Compliance shouldn’t leave you more confused than when you started. We’re pulling back the curtain on how we’re rebuilding the VanRein experience so growing teams can reduce risk, build trust, and stay audit ready without living in spreadsheets or clunky “click it and forget it” platforms. We talk about what “Compliance, Elevated” means in real life: clearer communication, a smoother audit flow, and deliverables you can actually use when customers, leadership, or regulators ask hard questions. You’ll hear how we redesigned website around simple paths so you can choose what you need right now, whether that’s full compliance support, training-only, policies, or a tailored mix. We also explain why we highlight industries served and client reviews, because trust in compliance is earned through proof. Then we get practical with VRC1. We built it to help you track your compliance progress with authority, understand what evidence is being requested, and keep everything organized. We also dig into training, including true HIPAA privacy officer and compliance officer certifications, plus AI training options that range from free to deep and robust. Finally, we share a tool we’re excited about: the AI Exposure Score, a quick self-assessment that rates your AI risk without grabbing your email. Check the resources, try the tools, and tell us what “elevated” should feel like for your team. If this helps, subscribe, share it with a teammate, and leave a review so more teams can find a calmer path to audit readiness. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail The scariest AI security story usually doesn’t start with a hacker. It starts with a helpful employee who’s behind on work, copies a “quick” email draft or meeting notes into a free chatbot, and accidentally hands over sensitive data without realizing it. That’s the real shift we’re seeing during Cybersecurity Month: AI safety is now tied to everyday behavior, not just firewalls and phishing training. We break down what shadow AI looks like in real organizations, from browser extensions and AI note takers to chatbots and “free tools” someone found online. We talk through the hidden question leaders need to ask: where does that data go next? If your team is remote, moving fast, and experimenting constantly, leadership may only see a small slice of the tools actually being used. And when AI is wrong, it can be confidently wrong, which is why human review and a simple QA step still matter. Rather than banning AI, we lay out practical guardrails: keep an approved list of AI tools, require business accounts instead of personal logins, track usage with a simple request form, and treat AI like a third-party risk with a basic register and data flow map. We also cover offboarding and why enterprise access matters so the knowledge your team builds doesn’t walk out the door. If you want a clear, lightweight approach to AI governance, AI security, and protecting customer data, hit play, subscribe, and share this with a leader who needs it, then leave us a review with your biggest AI safety question. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail HIPAA can feel like background noise in a busy chiropractic practice until a phone slip, a rushed front-desk moment, or a vendor breach makes it painfully real. After coming back from ChiroFest, we sit down with Emma from our team to talk about what we heard from chiropractors across the Pacific Northwest and what clinics are still missing when it comes to HIPAA compliance, patient privacy, and audit readiness. We dig into the patterns we saw on the expo floor and in real conversations: offices doing “something” but not the right things, teams relying on paper, and owners exhausted from trying to DIY policies, procedures, and training. We explain why staff training is the best first move if you want quick wins, fewer near-misses, and a clinic culture that actually knows how to handle PHI and ePHI day to day. We also share what makes training work in a chiropractic setting: realistic scenarios, short modules, simple quizzes, and proof of completion. Then we get blunt about vendor risk. New EHRs, AI tools, schedulers, and integrations can expand your exposure fast, and a “HIPAA compliant” seal on a website does not equal real safeguards. We talk about asking hard questions, looking for a trust center, and using vendor questionnaires so you know who is touching your data and what happens when something goes wrong. If you want to reduce risk without overwhelm, hit play, share this with a practice owner, and subscribe for more practical compliance guidance. If the episode helps, leave a review and tell us what HIPAA question you want answered next. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail HIPAA compliance has a way of becoming your job without asking permission, and that’s when panic usually sets in. We take a different angle: confidence isn’t perfection and it definitely isn’t memorizing regulations. For us, confidence comes from clarity you can prove later, knowing who owns decisions, what got approved, and how to show evidence six months from now when an auditor or customer asks.  We dig into the places where compliance programs get shaky fast: vendor management and third-party risk. When IT, Legal, Compliance, and Procurement all point at each other, the risk ends up owned by nobody. We explain how to assign a real owner, document the workflow, and keep Business Associate Agreements and vendor due diligence from becoming an endless loop. From there we get practical about “evidence” and what actually holds up: policies, training records, screenshots of MFA and access controls, and documentation that matches how work happens day to day.  Then we tackle the biggest hot button right now: AI governance for healthcare and HIPAA-regulated teams. AI note takers, writing assistants, and meeting transcription tools can be powerful, but the real questions are where the data goes, what settings quietly share it, and whether the vendor’s security posture matches your risk tolerance. We also ground the conversation in fundamentals that never go away: backups, redundancy, testing, and staying aligned with the HIPAA Security Rule even as proposed updates evolve.  If you found this helpful, subscribe and share it with the person who just inherited compliance. Leave a review, and tell us what risk you’re tackling first this week. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail We distill the biggest takeaways from the HHS NIST annual cybersecurity conference into clear actions for healthcare leaders who need to stay HIPAA compliant without getting buried. We connect breach trends, OCR enforcement priorities, ransomware realities, and AI governance into one practical roadmap for reducing risk and protecting patient care.  • healthcare breach trends and why hacking plus email and servers dominate  • why HIPAA compliance must include MFA, access controls, backups, and vendor controls  • OCR enforcement priorities, including right of access and risk analysis expectations  • how to run a real risk analysis by following ePHI across systems and third parties  • why medical device security and proper disposal can make or break compliance  • patient safety as the core cybersecurity outcome during outages and downtime  • emerging threats like quishing, social engineering, nation-state activity, and DDoS  • third-party risk lessons from the Change Healthcare ransomware incident  • practical AI governance using the NIST AI Risk Management Framework  • next steps, including AI inventory, incident response testing, and workforce training  Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail A major HIPAA reset is brewing, and the timing couldn’t be more urgent. We’re headed to the HHS, OCR, and NIST Safeguarding Health Information conference to hear directly from the people shaping what “good” looks like for HIPAA Security Rule compliance in 2026 and beyond, and we’re sharing exactly what we’re listening for. We talk through the likely headline items: OCR updates after a long gap, a stronger push toward risk analysis that behaves like a real audit, and the patterns OCR keeps calling out when organizations fall short. We also dig into the controls that keep coming up in real enforcement and real breaches: multi-factor authentication, penetration testing, incident response planning, and disaster recovery testing. If your security work is still “we did it once and filed it,” this conversation is your nudge to build ongoing evidence and remediation into the way you operate. Then we zoom out to the messy, modern reality of healthcare data. Vendor risk management is still a huge weak spot, especially as third parties, subprocessors, and AI tools multiply the paths ePHI can travel. We also get nerdy about what’s next with AI in healthcare, the NIST AI Risk Management Framework, and why regulation will struggle to keep pace. And we don’t ignore the physical world: medical device cybersecurity and IoT mean ePHI no longer lives only inside an EHR or EMR. Subscribe so you don’t miss our post-conference breakdown, and if this helped, share it with a teammate and leave a quick review so more healthcare teams can find it. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail The compliance landscape has changed more in the last 26 years than most leaders want to admit and somehow the basics still win. We connect the dots between real-world HIPAA enforcement and what actually holds up when something goes wrong: evidence. Not a binder. Not a trust center page. Proof that you know your systems, control access, manage vendors, and can recover fast. We start with the HIPAA Security Rule and why its administrative, physical, and technical safeguards still define the floor for protecting ePHI. Then we unpack the 2013 Omnibus Rule and the moment business associates stop being “adjacent” to HIPAA and become directly accountable. We clarify covered entity vs business associate, why incidental contact still counts, and how to use business associate agreements the right way without stuffing them full of unrelated cybersecurity obligations. From there we look forward to HHS’s proposed HIPAA Security Rule rewrite and the themes leaders should already be planning around: multi-factor authentication, encryption, asset inventories, network maps and data flows, vulnerability scanning, penetration testing, stronger recovery expectations, and heavier documentation. To make it real, we pull up the HIPAA Wall of Shame and talk through the patterns that keep showing up: hacking, email compromise, and exposed servers impacting organizations of every size. We close with what to do now: name an owner, build a repeatable rhythm, tighten access control and third party oversight, add AI guardrails to policies, and test backups and incident response until you can prove it works. Subscribe for updates on what HHS announces next, share this with the person who owns compliance at your company, and leave a review with your biggest HIPAA challenge so we can tackle it next. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail Twenty-six years goes fast when you’re building a life, not just chasing wins. Rob and Don celebrate their anniversary by getting honest about what actually holds up over decades: setbacks you didn’t plan for, career pivots you didn’t want, and the daily choice to keep moving forward without keeping score. We trace the through-line from marriage to leadership to business, including why “legacy” has nothing to do with leaving a pile of stuff behind. For us, legacy means the values, stories, and skills we pass to our son and to the team we get to lead. Along the way, we share practical lessons for entrepreneurs, small business owners, and growing teams who want more trust and less chaos, including how role clarity turns conflict into traction. A big part of that clarity is naming the lanes: visionary and integrator, strategy and operations, ideas and execution. That same discipline shows up in strong compliance programs, too. Whether you’re thinking about HIPAA compliance, staying audit-ready, or simply running a business that doesn’t burn you out, clear ownership and good communication reduce risk and make it easier to scale. We also talk about presence as a real leadership skill, especially in a phone-saturated culture and a remote-work world. If you want a stronger relationship, a healthier team culture, and a business built for the long game, this one will hit home. Subscribe, share this with a builder in your life, and leave a review with the season you’re in right now. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail Sending our son off to college makes leadership feel personal, and it forces us to practice trust instead of control. We connect parenting, team management, and compliance by focusing on guardrails, good judgment, and the freedom to fail forward.  • Watching an 18-year-old build independence through deadlines, decisions, and preparation  • Seeing what kids learn from what we model, not just what we say  • Letting go to grow, at home and at work  • Giving teams tools and guardrails instead of relying on massive SOPs  • Hiring the right people so they can make decisions without constant approval  • Normalizing mistakes and coaching toward “fail forward” learning  • Asking “what’s your solution?” to build ownership and problem-solving  • Being available as leaders without staying in control  • Using weekly cadence and check-ins to create clarity without micromanagement  • Blaming the process first, then addressing repeated issues as people issues  • Connecting compliance culture to everyday decisions across HIPAA, SOC 2, ISO, HITRUST, GDPR  • Using the grocery cart question as a simple integrity signal  • Setting expectations for grades and communication, then trusting the next season  Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail Two new HIPAA certifications are launching, and we built them for one reason: most “HIPAA training” proves attendance, not capability. We see smart, capable people get handed the compliance binder and suddenly they are the privacy officer, security lead, or HIPAA compliance officer with real legal and operational responsibility. That is a risky place to be for you and for your organization, especially when auditors expect evidence, not intentions.  We walk through our new professional credentials, Certified HIPAA Privacy Associate and Certified HIPAA Compliance Officer, and explain exactly who each path fits. The Privacy Associate track is for healthcare professionals and business associates who need practical HIPAA knowledge to make good decisions, spot problems early, and escalate issues correctly. The Compliance Officer track goes deeper into running a HIPAA compliance program: risk analysis methodology, breach response, policy ownership, training oversight, corrective action plans, and how to show proof during an audit.  We also dig into the modern reality of HIPAA compliance: vendor sprawl, downstream subcontractors, and AI in healthcare. If your team is connecting tools, experimenting with public AI, or relying on “my IT vendor handles it,” you need stronger governance, clearer questions, and better documentation. If you want credible HIPAA certification that supports audit readiness, risk management, and career growth, this is your roadmap.  Subscribe for more practical compliance guidance, share this with the person who just got assigned HIPAA, and leave a review with the question you want us to tackle next. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail We’re launching VRC1 OS, our compliance operating system built to bring structure, clarity, and real visibility to programs that have become scattered across tools, email, and spreadsheets. We explain why compliance has to run like a business function, how AI can reduce friction without replacing judgment, and what growing teams should expect when they stop chasing audits and start operating compliance.  • why compliance feels fragmented across policies, training, evidence, risk, and audit communication  • why trust centers and “green lights” do not equal real security proof  • what VRC1 OS centralizes: tasks, evidence, policies, training visibility, risk readiness, audit prep, client communication, and framework alignment  • why compliance is ongoing and touches HR, IT, legal, leadership, operations, vendors, and client trust  • how a rhythm reduces fire drills and keeps accountability clear  • why humans still provide judgment while automation removes friction  • how AI governance, vendor oversight, and cyber insurance pressure raise the bar  • who VRC1 OS is for across HIPAA, SOC 2, ISO, HITRUST, and security readiness  If your company is ready or you want to dive a little bit deeper, stop chasing compliance and start operating it. We’d love to show you what we’re building and continue to invite you into the Van Ride family. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail We talk about why founder-led and family-owned companies need to treat compliance as protection for trust, reputation, and long-term growth. We share the most common gaps we see as teams scale and how to build simple ownership so you stay audit ready without getting overwhelmed.  • why founder-led compliance feels personal and why reputation matters  • compliance as protection for clients, payroll, and the business foundation  • how client questionnaires and certifications drive trust and sales  • common gaps we see: outdated policies, weak training, inconsistent processes  • vendor and third-party risk, including where data flows downstream  • risk analysis as the backbone for finding vulnerabilities and audit readiness  • AI tools used without approval and the data security impact  • succession planning and access control for legacy businesses  • operational ownership of compliance, including HR compliance across states  • M&A due diligence beyond the P&L, focusing on breaches and security debt  reach out to us. Put us in the chat, send an email to hello at Van Ryan Compliance.com, and Shay will grab that and we'll schedule time to do a founder compliance review. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail The “trust center” trend is getting weird fast. If your security page is a glowing badge, a wall of green checks, or a portal that forces buyers into an access request black hole, we think you’re signaling the wrong thing and losing deals you should be winning. We break down why traditional GRC tooling often turns into compliance theater: lots of workflows and mapped controls, but very little proof when a customer asks for the last risk analysis, a HIPAA audit artifact, a SOC 2 report, an ISO 27001 result, or a penetration test. With HIPAA 2026 changes raising the bar, smarter SOC 2 and ISO buyers comparing vendors, and AI risk forcing real visibility into data flows and tool approvals, “we’re compliant” is no longer a convincing answer. We share a practical blueprint for building a real trust center backed by evidence. That means linking to the right reports (without dumping confidential data), publishing executive summaries for pen tests and vulnerability scans, showing MFA enforcement and encryption proof, and keeping dates, signatures, and update cadence visible so trust builds over time. We also talk about vendor oversight and risk visibility, including how to think about sharing risk in a way that shows maturity rather than perfection. If you want your compliance program to speed up sales instead of slowing it down, listen now, then subscribe, share this with your security or revenue team, and leave a review so more builders can move from checkboxes to real trust. Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail AI is already inside your business, and the uncomfortable truth is you might not even know where. Copilot in Microsoft, Gemini in Google, bots layered on top of bots, and “quick tests” in personal accounts all create real compliance risk the moment sensitive data enters the mix. At the same time, regulation is tightening fast, which means the gap between how teams use AI and what auditors expect is getting more dangerous by the week. We walk through what’s changing globally with the EU AI Act and its risk-based tiers, then bring it home to the US reality with HIPAA compliance and the coming pressure on the HIPAA Security Rule. We talk plainly about what enforcement-ready security looks like: multi-factor authentication everywhere ePHI touches, encryption in transit and at rest you can prove, audit logging that shows who did what, and risk assessments that aren’t just checklists. We also dig into vendor accountability, why Business Associate Agreements still matter, and how to validate a partner’s security posture through trust centers, real certifications, and subprocessor transparency. Then we get practical about AI governance. We share the guardrails we rely on: mapping data flows, keeping an AI tool inventory on your supplier register, setting an AI usage policy your team can actually follow, and using a human-in-the-middle approach to reduce hallucination and patient-safety liability in healthcare AI. If you’re trying to stay audit ready for HIPAA, SOC 2, ISO 27001, or HITRUST while still moving fast with AI, this gives you a clear path forward. Subscribe for more compliance and security guidance, share this with your leadership team, and leave a review if it helped. What AI tool is already embedded in your workplace stack? Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook

Send us Fan Mail AI is already inside your healthcare workflows, your vendors, your phones, and your inbox. The hard part is not getting access to the tools. The hard part is using AI without quietly leaking PHI and waking up to a HIPAA breach you never saw coming. We break down the question most teams ask the wrong way: “Is AI HIPAA compliant?” HIPAA wasn’t written for large language models, but the law still applies, and the responsibility still lands on you. We walk through how AI fits into the HIPAA Privacy Rule (who can access PHI), the HIPAA Security Rule (encryption, access controls, audit logs, and evidence), and the HIPAA Breach Notification Rule (what you must do when something goes wrong). We also talk about why “HIPAA-ready” marketing claims mean nothing without a signed Business Associate Agreement (BAA) and a real vendor risk conversation. Then we get practical: shadow AI, staff copying PHI into chat tools, data leakage through model training defaults, and the basic governance moves that prevent all of it. You’ll hear our recommended AI acceptable use policy structure, how to build an AI inventory and risk register, what an AI risk assessment should evaluate, and why penetration testing and vulnerability scanning matter even more as regulations tighten. If you want to move fast without losing control, subscribe, share this with a teammate who’s rolling out AI, and leave a review. What AI tool is your organization using today, and do you have a BAA for it? Thank You for Listening to the VRC Podcast! Visit us at VanRein Compliance You can Book a 15min Call with a Guide Follow us on LinkedIn Follow us on X Follow us on Facebook