Access to health and genetic data follows the need-to-know principle; processing under GDPR Article 9(2)(h) and (i) must be done by a professional bound by secrecy or another person under a confidentiality duty with adequate information security; access is exclusively electronic unless technically impossible or the data subject says otherwise, with onward disclosure or transmission barred; officers, staff, service providers, the DPO, health students and researchers and all health professionals with access, and those who oversee, fund or inspect care, are bound by secrecy; minimum security measures (differentiated access permissions by need to know and segregation of duties, prior authentication, electronic logging of access and data accessed) are to be set by a health and justice ministerial order (portaria, not held). Article 30: centralised health databases on single platforms must meet GDPR security and inviolability requirements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.