encryption of wsse:security headers

If you want to encrypt a security header, can you replace it with just 
an EncryptedData element,
or do you need another place to store an EncryptedKey or a ReferenceList?