VRC: Audit Ready

New Podcast Episode:

AI is rapidly becoming part of everyday business operations. But without governance, it can quickly shift from a competitive advantage to a serious compliance and security risk. In this special episode, Rob and Dawn are joined by Bennie Cleveland, VanRein Compliance’s lead auditor with more than two decades of experience in cybersecurity, enterprise risk, and audit strategy across highly regulated industries.

Together, they unpack what AI governance really means in practice, why regulators are now asking how organizations govern AI (not just if they use it), and how businesses can stay secure, compliant, and audit-ready as AI adoption accelerates.

In This Episode:

• What AI Governance Really Is — ownership, approved tools, monitored outcomes, and defensible use

• Why Regulators Are Paying Attention — AI’s role in health, financial, employee, and personal data

• Cyber, Privacy, and Compliance Risk — how AI expands existing security and legal exposure

• NIST, GDPR, and Industry Frameworks — mapping AI governance into established compliance standards

• Deepfakes, Social Engineering, and Data Loss — real-world threats amplified by AI capabilities

• Tabletop Exercises for AI Risk — testing resilience through simulated cyber incidents

• Human-in-the-Loop Accountability — why leadership still owns AI-driven outcomes

• Common Audit Failures — weak incident response, disaster recovery, and communication planning

• The Real Competitive Advantage — embedding governance into audit and risk programs early

If your organization is adopting AI (or feeling pressure to) this episode delivers clear, audit-level insight into how to move forward with confidence, security, and defensible governance. Listen now!

Featured Article

Together with

AI in the workplace is here. You’ve likely heard that you must have a governance plan, implementation plans, training, and more during 2026. You need to do that regardless of whether federal, state, and even international regulators have their acts together… and they don’t.

An Executive Order was signed in December 2025 to ensure a “minimally burdensome” national framework is in place. That EO directs the Attorney General to form an AI Litigation Task Force to monitor and challenge state laws it deems inconsistent and potentially creating regulatory chaos. The AG has until early March 2026 (approximately 90 days from issuance) to evaluate state laws and recommend federal preemption legislation.

States with AI laws in place or soon will:

• California

• Colorado

• Texas

• Illinois

• New York

California’s laws focus on transparency (disclosures, watermarking), safety, whistleblower protections, and restrictions on AI in hiring and employment.

Colorado’s law doesn’t kick in until June 30, 2026. It requires risk management, risk assessments, and protections against “algorithmic” discrimination in high-risk systems (read: healthcare, financial services, employment, and other consequential decisions).

Texas’ law limits manipulative uses and requires full disclosure. It prohibits certain harmful or discriminatory applications of AI, with emphasis on transparency and governance.

Illinois and New York have rules in place for employment decisions, synthetic media, and government use.

The EU AI Act has been phasing into action since 2024 and will continue going into force through 2027. If you conduct any business in Europe, you’re impacted by these rules. If not, it’s reasonable to expect some of those ideas to migrate into U.S. federal and state laws, so the entire regulatory environment is “fluid” at best right now.

You can read more about this act here: https://artificialintelligenceact.eu/the-act/

A-I Regulatory uncertainty is a given in 2026, and this doesn’t include updates to HIPAA, which is why VanRein Compliance is here to help. Our team is constantly watching new legislation being proposed, tracking its progress (or lack thereof) through legislative bodies, and adapting our audit processes and policies to keep our clients ahead of the curve and minimizing surprises. Lower your risk by increasing your governance efforts with Team VRC. Don’t compromise your business, your reputation, your clients, and their trust. It’s About T1me!

Compliance Feature

Let's talk about something that's non-negotiable in healthcare. Keeping protected health information (PHI) safe matters. HIPAA is not just another regulation.  It protects patient trust, quality care, your organization's future and compromises integrity.

The Privacy Rule says every team member needs training on PHI policies tailored to their job.  The Security Rule requires ongoing awareness training for everyone, including leadership, to spot and stop threats to electronic PHI.  New hires get trained right away.  Refreshers happen when policies change or risks appear.  Skipping this is not an option.  It is a must to prevent leaks, unauthorized access, or careless mistakes.

Reality Check: Most HIPAA breaches come from human error, not hackers.  Weak or outdated training opens the door to phishing scams, improper sharing, skipping the minimum necessary rule, or losing devices with patient data.  The Office for Civil Rights (OCR) routinely points to poor training in enforcement cases.  Unauthorized access, lost unencrypted laptops, and accidental disclosures often lead to bigger fines because of those gaps.

Civil penalties can hit $2 million or more per violation, with annual caps in the millions for repeats.  Criminal charges apply in extreme cases.  Add breach notifications, legal fees, corrective plans, and lost business.  State attorneys general can pile on too.  Bottom line... Inadequate training does not just risk violations, it weakens the very protections patients rely on against identity theft, discrimination, or privacy harm.  Regulators see preventable training failures as a red flag.  That drives higher penalties.

VanRein Compliance Makes It Easier
This where VRC comes in. Our comprehensive HIPAA training videos and materials are built to be practical, engaging, and fully up-to-date. You meet and exceed requirements without the headache.

• Role-based modules hit the essentials. Spotting PHI, minimum necessary, secure sharing, no snooping, cyber awareness, breach reporting.

• Interactive videos use real scenarios that actually stick with your team.

• Ongoing refreshers keep everyone current as threats and rules evolve.

• Easy tracking and documentation make you audit-ready anytime.

Partnering with VRC means your people handle PHI confidently. Human-error incidents drop. You show regulators you are serious about compliance. Good training is not just penalty avoidance, it is how you earn and keep patient trust every single day. You can’t afford to wait for a breach or surprise audit to find the gaps. Reach out to Team VRC today. Let us get your training needs dialed in. It's About Time!

Sponsor Spotlight

Trust-First AI, Built Into Your Browser

Agentic workflows are everywhere. Real trust is still rare.

Norton Neo is the world’s first AI-native browser designed from the ground up for safety, speed, and clarity. It brings AI directly into how you browse, search, and work without forcing you to prompt, manage, or babysit it.

Key Features:

• Privacy and security are built into its DNA.

• Tabs organize themselves intelligently.

• A personal memory adapts to how you work over time.

• This is zero-prompt productivity. AI that anticipates what you need next, so you can stay focused on doing real work instead of managing tools.

If agentic AI is the trend, Neo is the browser that makes it trustworthy.

Try Norton Neo and experience the future of browsing.

Download Norton Neo

The comprehensive IT-industry rundown

Every day, IT teams make decisions that affect security, budgets, and how the business runs.

IT Brew is built for those moments—delivering clear, timely coverage of the trends shaping IT so you understand what’s changing before it turns into a meeting, a ticket, or a fire drill.

Join 125K+ industry pros reading {IT Brew’s newsletter} for free.

Check it out

Podcast Essentials

YOUR WEEKLY PODCAST FEATURE

Newsletter Features

COMPLIANCE DISCOVERIES

A VanRein Compliance Reminder