A covered entity must provide a process for individuals to make complaints about its privacy policies and procedures or its compliance with them, and must document complaints received and their disposition, per 164.530(d).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.