Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

HHS HIPAA Guidelines Target Tracking on Public Web Pages

The U.S. Department of Health and Human Services (HHS) has shared new guidance on HIPAA. This guidance focuses on using tracking technologies on public healthcare pages. This updated directive directly impacts healthcare organizations utilizing tools like Meta Pixel, Google Analytics, or session replay scripts. While these are effective for understanding user engagement, they may inadvertently collect PHI—protected health information—if configured improperly.

How compliance frameworks strengthen security and insurability

This blog was written in partnership with the Vouch team. ‍ Today, cyber threats are more pervasive than ever, with businesses facing increasing risks from data breaches, ransomware attacks, and regulatory fines. To mitigate these threats, many companies turn to cyber insurance for financial protection. ‍ However, securing and maintaining cyber insurance isn’t just about paying a premium.

Top 5 HIPAA Pitfalls That Lead to PHI Leaks on Websites

Maintaining HIPAA compliance on healthcare websites is crucial for protecting PHI (Protected Health Information) and upholding patient privacy. The Health Insurance Portability and Accountability Act (often referred to in short form as HIPAA or the portability and accounting act) was introduced in the United States to address the health insurance portability, security, and accountability requirements within the healthcare industry.

Security Threats to Payroll Data: How Can Your Firm Manage Them?

In modern, connected workplaces, security is a perpetual concern. Some departments in your organization handle high-risk information, such as personal employee data and company finances. Any data breach can bring on a reputational crisis and endanger internal strategic approaches. In February 2025, HR Dive reported the impact of a data breach at an employee screening services provider. The breach affected an unnerving 3.3 million people, leaking people's names and financial account information. Social Security numbers and other ID numbers also got compromised.

Egnyte CMMC Compliance Overview

Cybersecurity Maturity Model Certification (CMMC) is a certification program that’s required for all U.S. Department of Defense (DoD) contractors to ensure they have the necessary controls to protect sensitive information. CMMC is anticipated to appear in DoD contracts as early as mid-2025. Egnyte provides an EgnyteGov secure data enclave to help manage CUI and FCI and to help you achieve compliance. Sign up for our CMMC consultation to learn how Egnyte can help with your CMMC compliance journey, so you can continue bidding on DoD contracts.

AI and Compliance with Adam Winston

This week on the podcast, we bring in Adam Winston, former CSO of ActZero and current Field CTO for Managed Services at WatchGuard to discuss automating the SOC with AI. We cover the history of AI in SecOps, the good and bad applications of AI and Machine Learning, what the future looks like, and how compliance might impact our ability to get there.

Why Secure Custom Application Development Is a Must for Modern Businesses

Security isn't just a technical concern anymore it's a core part of doing business. Many companies find themselves relying on pre-built software that wasn't designed with their specific risks or workflows in mind. These off-the-shelf tools may offer basic functionality, but they often lack the control, adaptability, and protection modern teams need. That's why more organizations are investing in custom application development: to build systems that fit their operations and protect what matters most.

4 lessons learned during our ISO 42001 audit

Vanta is proud to be one of the first companies to achieve ISO 42001 compliance with our audit partner Schellman, an ANSI-accredited ISO 42001 auditor. ‍ To prepare for and pass our audit, our team worked diligently to assess our specific business needs, communicate clearly with stakeholders and AI leadership, and complete formal training to learn how to develop, integrate, and deploy trustworthy AI systems in line with emerging laws and policies.