A covered entity must notify the Secretary of HHS of breaches of unsecured PHI: for breaches affecting 500 or more individuals, contemporaneously with the individual notice and in the same manner as media notice where applicable (no later than 60 days after discovery); for breaches affecting fewer than 500 individuals, in a log submitted no later than 60 days after the end of the calendar year in which the breaches were discovered, per 164.408.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.