Health data processing is subject to extra controls restricting access, including medical files, and processing to the minimum number of staff necessary for health services or insurance (Law 23). The Controller adopts the requirements of the Ministry of Health, Saudi Health Council, Saudi Central Bank, Council of Health Insurance and other regulators; builds the Law into internal policies; separates duties and access levels; documents every processing stage with the responsible person; binds processors to these measures; and minimises processing (IR 26).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.