Discloses how the device, and processing on it, treats PII: whether it can display, transmit, store or modify PII such as ePHI, listing the elements it can hold (patient name, ID, social security number, biometrics) (MPII-1); whether it maintains PII (MPII-2), and in particular temporarily in volatile memory until power-off or reset (2.1), persistently on internal media (2.2), in non-volatile memory until explicitly erased (2.3), in a database (2.4), with a setting to delete local PII automatically once it is stored in a long-term solution (2.5), exchanged with other systems (2.6, for example a wearable exporting to a server), retained through power-off or power interruption (2.7), on internal media a service technician can remove for separate destruction or customer retention (2.8), and in a location separate from the operating system such as a second drive, partition or remote store (2.9). MPII-3 asks for the mechanisms used to move PII, noting which are options: display (3.1), hard-copy reports or images (3.2), removable media such as removable drives, USB memory, optical discs, tape and memory cards (3.3), dedicated cable connections such as RS-232, RS-423, USB or FireWire (3.4), wired networks (3.5), wireless networks including WiFi, Bluetooth, NFC, infrared and cellular (3.6), external networks such as the internet (3.7), document scanning (3.8), proprietary protocols (3.9) and any other mechanism, described (3.10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.