Research in a practice carries obligations that routine care does not. Before any research project starts the practice confirms it has approval from a human research ethics committee and that indemnity cover matches the level of risk to participants and the practice. Where a practice shares identifiable patient information with an outside party for a quality improvement or professional development purpose, such as a clinical audit run by an external body, it first obtains the patient's consent; de-identified data does not need it. A practice that does no research records that the Criterion does not apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.