It is prudent for plan fiduciaries to select service providers capable of protecting sensitive participant and beneficiary information and obligate them, by written contract, to protect that information. As is often said, “You can outsource the work, but you cannot outsource the responsibility.” It is important to check that the service provider implements appropriate privacy and security systems and that all groups with access to the plan’s sensitive personal information are obligated to protect that information.