Research carries obligations routine care does not. Before any research project starts the service confirms it has approval from a human research ethics committee and that indemnity cover is in place. Where the service shares identifiable patient information with an outside party for a quality improvement or professional development purpose, it first obtains the patient's consent; de-identified data does not need it. A service that does no research records that the Criterion does not apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.