A covered entity may disclose PHI to a business associate, and may allow a business associate to create or receive PHI on its behalf, only after obtaining satisfactory assurance in a written contract or other arrangement meeting the required elements of 164.502(e) and 164.504(e): permitted uses and disclosures, appropriate safeguards, breach and security-incident reporting to the covered entity, subcontractor flow-down of the same restrictions, return or destruction of PHI on termination, and the covered entity's right to terminate for material breach.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.