A business associate that holds, uses or discloses unsecured protected health information must, following discovery of a breach, notify the covered entity and identify each individual whose information has been or is reasonably believed to have been accessed, acquired or disclosed. The business associate bears the same discovery rule and the same 60-day outer limit, and under the 2013 Omnibus Rule its subcontractors owe it the same notice.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.