How can the RME protect confidential client information when using subcontractors?

• A. Share all information broadly
• B. Let subcontractors access all data as needed
• C. Require confidentiality agreements and limit access to necessary personnel
• D. Do not protect information

Answer: (C)

Protecting confidential client information when engaging subcontractors hinges on controlling access and enforcing obligations. The best approach is to require confidentiality agreements and limit access to only those who need it to perform their work. A confidentiality or data protection agreement creates the legal duty to keep information secure and defines permitted uses, while restricting access follows the principle of least privilege to minimize exposure. Additional safeguards such as data minimization, secure data transfer, and revoking access when the project ends reinforce protection. Sharing information broadly, giving subcontractors unrestricted access, or failing to protect data increases the risk of leaks or noncompliance.