| Now Live: 42 CFR Part 2 Training
Plain, practical training that shows operators, dispatchers and supervisors how to apply Part 2 on every call.
WHY NOW
The updated Part 2 rule has been enforceable since Feb 16, 2026, with the same penalties and breach notification rules as HIPAA.
| Year-End Readiness
Two Months Left. Three Things to Close Out.
Hi there,
There are about eight weeks left in 2026, and December always goes faster than we plan for. Before the holidays take over, here are the three things we're asking every client to finish this year:
Refresh your risk analysis. If it's more than a year old, or your systems, vendors or staff changed this year, it's out of date. Add anything new, including the AI tools your team started using.
Finish this year's training. Make sure everyone, including new hires, has completed training and has a certificate on file you can show.
Check your vendor list against your BAAs. Every vendor that touches patient data needs a signed business associate agreement. New software picked up mid-year is the usual gap.
One more thing: starting this week you'll hear from us twice a week, on Tuesdays and Thursdays. Same short format, more timely.
| This Week's CVEs from CISA
New to CISA's Known Exploited Vulnerabilities (KEV) catalog since our last issue. Several due dates have already passed, so if you run any of these, treat them as today's work.
CVE-2026-111357 and CVE-2026-118527 | Ivanti Connect Secure (remote-access VPN). Two newly exploited flaws that CISA says attackers chain with an earlier one to take over the VPN appliance. Patch or apply the vendor mitigation, and check for signs of compromise. KEV due dates: November 2 and November 13, 2026.
CVE-2026-76418 | Cisco Secure Firewall ASA and FTD. An attacker with no login can make the firewall reboot, knocking your network and VPN offline. Patch or apply the vendor mitigation. KEV due date: November 1, 2026.
CVE-2026-46300 | Linux kernel. Chained with the PHP flaws from our last issue, it lets attackers fully take over a Linux web server. Patch or apply the vendor mitigation. KEV due date: October 31, 2026.
CVE-2026-97229 | GitLab Community and Enterprise Edition (self-hosted). Someone with no password can run code on a GitLab server. Patch or apply the vendor mitigation. KEV due date: November 1, 2026.
CVE-2026-41709 | Broadcom VMware ESX. An attacker who already has admin access can act without it being logged, hiding their tracks. Patch or apply the vendor mitigation. KEV due date: November 11, 2026.
For our energy clients: CISA also published industrial control system advisories for Hitachi Energy TRO600, CoreTec, PCM600 and MSM. Check with your OT vendor.
Why it matters for HIPAA: your risk analysis should flag known exploited flaws on systems that touch patient data, and your patch management records should show when you fixed them.
| Framework Spotlight
SOC 2: Who Asks for It, and Which Type You Need
If you sell software or services to larger companies, a SOC 2 request usually shows up in a security questionnaire or a contract review. SOC 2 is a report from an independent CPA firm on your controls, measured against the AICPA's Trust Services Criteria: security, plus availability, processing integrity, confidentiality and privacy where they apply.
The first decision is the type. A Type 1 report looks at whether your controls are designed properly at a single point in time. A Type 2 report tests whether they actually worked over a period of time, and it's the one most customers ultimately want.
For healthcare vendors, SOC 2 and HIPAA overlap a lot, but one doesn't replace the other. And a heads-up: on October 26 the AICPA released proposed 2027 updates to the criteria. They're proposals for now, so keep working to the current ones.
Listen: Our latest podcast episode, "Compliance, Elevated: The Next Chapter of VanRein", walks through how we rebuilt the VanRein experience so audits run smoother and deliverables are actually useful.
Check your AI risk: The AI Exposure Score takes about two minutes and shows where your team's AI use could be exposing data, a good input for that year-end risk analysis.
We Can Help
Want a hand closing out the year? We'll help you update your risk analysis, line up training for your whole team and check your vendor list, so you start 2027 with a clean file. Reply to this email or book a time below.
Thanks for reading, and for trusting us with your compliance.
Rob and Dawn Van Buskirk
Co-founders, VanRein Compliance
Compliance, Elevated.
