A covered entity must permit individuals to request amendment of PHI in a designated record set for as long as it is maintained, act on the request within 60 days (one 30-day extension permitted with notice), and, if denied, provide a written denial with the individual's right to submit a statement of disagreement, per 164.526.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.