If a law enforcement official states that notification would impede a criminal investigation or damage national security, a covered entity or business associate must delay notification for the time period the official specifies in a written statement, or for no longer than 30 days from an oral statement pending a written statement, per 164.412.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.