The administrative, physical and technical safeguards and the policies and documentation requirements of the Security Rule (45 CFR 164.308, 164.310, 164.312 and 164.316) apply to a business associate of a covered entity in the same manner as to the covered entity, and the additional security requirements of the title apply to it and must be written into the business associate agreement; the civil and criminal penalties of sections 1176 and 1177 of the Social Security Act apply to a business associate that violates them. The Secretary issues annual guidance on the most effective technical safeguards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.