A large hospital has an existing contract with a vendor in another country to provide software support and maintenance of the hospitals patient records Information system. From the hospital management perspective, which of the following controls would be most effective to address privacy risks related to this outsourcing arrangement? a) Conduct periodic reviews of the privacy policy to ensure that the existing policy meets current legislation requirements in both regions. b) Include a wright to audit clause in the contract and impose detailed security obligations on the outsourced vendor. c) Implement mandatory privacy training for management to help with identifying privacy risks when outsourcing services. d) Develop an incident monitoring and response plan to track breaches from internal and external sources.