Establish a program that keeps the system compliant with the minimum HIPAA requirements, together with a privacy policy and a cybersecurity breach policy. A small-system baseline control (Appendix K, category 3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.