A controller holding deidentified data must take reasonable measures so it cannot be associated with an individual, keep and use it only in deidentified form and not attempt reidentification except to test its deidentification, contractually bind recipients to comply with the part, and implement processes to prevent inadvertent release.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.