Cyber Expectations Are Rising. It Starts With Your People.

For years, cybersecurity training has focused on keeping attackers out. Don't click suspicious links. Don't open unknown attachments. Don't reuse passwords. These lessons still matter, but AI has introduced a completely different kind of risk.

Now, sensitive information can leave an organization without anyone hacking a system at all. An employee can simply paste patient information, financial data, internal documents, or proprietary business information into the wrong AI tool while trying to get work done faster.

In this Cybersecurity Awareness Month episode, we break down why AI safety starts with the employee and how organizations can embrace AI without losing control of their data.

AI isn't going away, and banning it entirely isn't the answer. The goal is to give employees the tools they need while making sure they understand where the boundaries are, what information should never be shared, and when human review is required.

Because in the age of AI, cybersecurity doesn't only depend on keeping bad actors out. It also depends on what your own people do with your data.

Ready to get your team there? Start with the training that fits:

Senate Passes the Health Care Cybersecurity and Resiliency Act

The U.S. Senate has passed the bipartisan Health Care Cybersecurity and Resiliency Act (S.3315) by unanimous consent. It still has to move through the House before it can become law, but the unanimous vote is a strong signal of where healthcare cybersecurity expectations are headed.

Bill Overview

The bill is aimed at strengthening cyber preparedness across healthcare, with special attention to small and rural providers. It would push healthcare organizations toward a baseline of core practices, including multifactor authentication and encryption of ePHI, along with minimum capabilities like penetration testing and ongoing monitoring. It also calls for alignment with widely used frameworks such as NIST.

It is not all stick. The bill also provides for training, technical assistance, and tailored guidance for under-resourced providers, and it directs HHS to coordinate more closely with CISA on incident response.

This Matters Now

A separate bill, the Health Infrastructure Security and Accountability Act, is also gaining ground and takes a tougher approach, with tiered mandatory standards and third-party auditing. Whichever path wins out, the direction is the same: the practices once treated as "nice to have" are becoming the expected minimum.

None of this is new to organizations already working under the HIPAA Security Rule. MFA, encryption, risk analysis, and tested incident response are things you should have in place today. The difference is that the bar is moving from "recommended" to "required," and the organizations that start now will not be scrambling later.

Get Ahead with VanRein Compliance

You do not have to wait for a final bill to start closing gaps. VanRein Compliance helps healthcare organizations and their business partners turn cybersecurity expectations into a program they can actually prove, from HIPAA risk analysis and policy development to penetration testing and vulnerability scanning. Partner with us to find your gaps, fix what matters first, and stay ahead of requirements before they become mandates.