If a breach involves unsecured PHI of more than 500 residents of a State or jurisdiction, the covered entity must notify prominent media outlets serving that State or jurisdiction without unreasonable delay and no later than 60 days after discovery, with content meeting the same 164.404(c) elements, per 164.406.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.