Step-by-Step Explanation:

COPPA Requirements in Healthcare Applications:

Disclose privacy policy and obtain parental consent:

“Organizations must provide clear privacy notices to parents and obtain their consent before collecting any personal information from children under 13.”

— Reference: Salesforce Security Guide, COPPA Compliance

Obtain verified parental consent before collection/storage:

“Verified parental consent is a core requirement for COPPA, prior to collection and storage of children’s personal data.”

Implement security measures:

“Appropriate security controls and safeguards must be in place to protect children’s data as mandated by COPPA.”

Encryption:

While encryption is a best practice (option D), COPPA explicitly requires appropriate security but does not mandate encryption at rest and in transit as a specific requirement, though it is recommended.

Partner Compliance:

Option E refers to the implementation partner, but regulatory responsibility remains with the covered entity (Bloomington Caregivers) , not the partner.