A large hospital has an existing contract with a vendor in another country to provide...

Conduct periodic reviews of the privacy policy to ensure that the existing policy meets current legislation requirements in both regions.

Include a "right to audit" clause in the contract and impose detailed security obligations on the outsourced vendor

Implement mandatory privacy training for management to help with identifying privacy risks when outsourcing services

Develop an incident monitoring and response plan to track breaches from internal and external sources