A covered entity (other than certain health care clearinghouses) must develop, provide and make available a notice describing individuals' rights and the entity's duties with respect to PHI, per the required content elements of 164.520(b), provide it at first service delivery and on request, post it prominently, and obtain (or document a good-faith attempt to obtain) a written acknowledgment of receipt from direct treatment providers' patients. The current notice must reflect any Part 2 substance-use-disorder content required from 2026-02-16; it must not restate the vacated 2024 reproductive health attestation language.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.