; (ii) strictly limit staff access to the data to staff with appropriate training, clearance, and background checks and require regular privacy and security training; (iii) maintain effective security standards for transferring data or making data available to authorized users; (iv) develop a process for providing access to data to authorized users, in a secure manner that maintains privacy and confidentiality of data