PMP Practice: Confirm project compliance requirements

Tane Whenua-Clarke is managing a hybrid project for Parallax Engine Co to develop a new telemedicine platform. The platform must comply with healthcare data privacy regulations in three countries: the United States (HIPAA), Canada (PIPEDA), and the European Union (GDPR). The team is using two-week sprints for feature development, with regulatory reviews conducted at defined milestones. During sprint planning for the upcoming iteration, the development team proposes building a patient messaging feature. Tane realizes that this feature will involve storing and transmitting protected health information, which has specific compliance requirements that differ across the three jurisdictions. The team has not yet consulted with the compliance officer or reviewed the regulatory requirements for this particular functionality. Which approach would be MOST effective for managing compliance in this situation?