Health information is no longer PHI, and may be used or disclosed without restriction, only if de-identified under the 164.514 Safe Harbor (removal of the 18 identifiers, with no actual knowledge the result could identify the individual) or the Expert Determination method, with the determination documented.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.