This section is documenting our path through the decision tree.  We have landed on and chosen CDS Hooks as the solution, so removing the line that says we've chosen CDS Hooks and why would make no sense. The need for security provisions is not a criteria around the selection/non-selection of CDS Hooks.  EHRs are free to impose 'appropriate' constraints on data access to CDS services.  The security considerations wouldn't have been any different if we'd used operations or messages - they simply wouldn't have been as elegant. The questions raised by implementers about the viability of CDS Hooks have been focused on preserving the status quo, where there is no decision support given to providers and all prior authorization considerations are handled in the back office.  That would be completely contrary to the objectives of this implementation guide.   However, to acknowledge the concern, we will add a new paragraph under the list of bullets describing our walk through the decision tree that says: "Because of the sensitivity around disclosure of clinical information to payer-controlled systems during the clinical workflow process, this IG imposes a number of safeguards around the use of the selected CDS Hooks technology to help ensure that providers and their systems have an appropriate degree of control over disclosure and that information can't be used in inappropriate ways."