16 CFR 318.3 + 318.4 + 318.5. INDIVIDUAL NOTIFICATION REQUIREMENT (318.3(a)): PHR vendor or PHR-related entity must notify each affected individual WITHOUT UNREASONABLE DELAY + IN NO CASE LATER THAN 60 CALENDAR DAYS after the date of DISCOVERY of the breach. DISCOVERY (318.4): a breach is treated as discovered as of the date the entity FIRST KNEW or REASONABLY SHOULD HAVE KNOWN of the breach; entities must conduct REASONABLE DILIGENCE in detecting + investigating; KNOWLEDGE imputed across the organization (any employee + agent + contractor with knowledge). METHOD OF INDIVIDUAL NOTICE (318.5(a)): (1) WRITTEN NOTICE via first-class mail to last known address + or EMAIL if affirmatively consented; (2) NEXT-OF-KIN notice if individual is deceased or cannot be reasonably contacted; (3) SUBSTITUTE NOTICE if insufficient contact information OR more than 10 affected persons - via prominent website posting + major media notice + toll-free number + 90+ days; (4) URGENT NOTICE option for imminent misuse. CONTENT (318.5(b)): brief description of incident + dates of breach + dates of discovery + types of information involved + steps individuals should take to protect themselves + steps the entity has taken (investigation + mitigation + protection) + contact information including toll-free phone + email + postal address + website. LANGUAGE: clear + plain language; multiple languages if appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.