How often should you run vulnerability scans? PCI DSS, HIPAA, CIS and insurance

The short version: PCI DSS requires internal and external scans at least every three months and after significant changes. HIPAA does not set a frequency today, but regular scanning supports the requ