A covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires, or as the individual (or personal representative) authorizes in writing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.