There’s one problem that surfaces again and again, regardless of which regulatory standard (e.g., HIPAA, PCI, etc.) we discuss: failing to understand the difference between compliance and security.