Path | Short | Definition | Comments |
---|---|---|---|
Event record kept for security purposes | A record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage. | Based on IHE-ATNA. | |
type | Type/identifier of event | Identifier for a family of the event. For example, a menu item, program, rule, policy, function code, application name or URL. It identifies the performed function. | |
subtype | More specific type/id for the event | Identifier for the category of event. | |
action | Type of action performed during the event | Indicator for type of action performed during the event that generated the audit. | |
period | When the activity occurred | The period during which the activity occurred. | The period can be a little arbitrary; where possible, the time should correspond to human assessment of the activity time. |
recorded | Time when the event was recorded | The time when the event was recorded. | In a distributed system, some sort of common time base (e.g. an NTP [RFC1305] server) is a good implementation tactic. |
outcome | Whether the event succeeded or failed | Indicates whether the event succeeded or failed. | In some cases a "success" may be partial, for example, an incomplete or interrupted transfer of a radiological study. For the purpose of establishing accountability, these distinctions are not relevant. |
outcomeDesc | Description of the event outcome | A free text description of the outcome of the event. | |
purposeOfEvent | The purposeOfUse of the event | The purposeOfUse (reason) that was used during the event being recorded. | Use AuditEvent.agent.purposeOfUse when you know that it is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why. |
agent | Actor involved in the event | An actor taking an active role in the event or activity that is logged. | Several agents may be associated (i.e. have some responsibility for an activity) with an event or activity. For example, an activity may be initiated by one user for other users or involve more than one user. However, only one user may be the initiator/requestor for the activity. |
agent.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
agent.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.type | How agent participated | Specification of the participation type the user plays when performing the event. | |
agent.role | Agent role in the event | The security role that the user was acting under, that come from local codes defined by the access control security system (e.g. RBAC, ABAC) used in the local context. | Should be roles relevant to the event. Should not be an exhaustive list of roles. |
agent.who | Identifier of who | Reference to who this agent is that was involved in the event. | Where a User ID is available it will go into who.identifier. |
agent.altId | Alternative User identity | Alternative agent Identifier. For a human, this should be a user identifier text string from authentication system. This identifier would be one known to a common authentication system (e.g. single sign-on), if available. | |
agent.name | Human friendly name for the agent | Human-meaningful name for the agent. | |
agent.requestor | Whether user is initiator | Indicator that the user is or is not the requestor, or initiator, for the event being audited. | There can only be one initiator. If the initiator is not clear, then do not choose any one agent as the initiator. |
agent.location | Where | Where the event occurred. | |
agent.policy | Policy that authorized event | The policy or plan that authorized the activity being recorded. Typically, a single activity may have multiple applicable policies, such as patient consent, guarantor funding, etc. The policy would also indicate the security token used. | For example: Where an OAuth token authorizes, the unique identifier from the OAuth token is placed into the policy element Where a policy engine (e.g. XACML) holds policy logic, the unique policy identifier is placed into the policy element. |
agent.media | Type of media | Type of media involved. Used when the event is about exporting/importing onto media. | |
agent.network | Logical network location for application activity | Logical network location for application activity, if the activity has a network location. | |
agent.network.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
agent.network.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.network.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.network.address | Identifier for the network access point of the user device | An identifier for the network access point of the user device for the audit event. | This could be a device id, IP address or some other identifier associated with a device. |
agent.network.type | The type of network access point | An identifier for the type of network access point that originated the audit event. | |
agent.purposeOfUse | Reason given for this user | The reason (purpose of use), specific to this agent, that was used during the event being recorded. | Use AuditEvent.agent.purposeOfUse when you know that is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why. |
source | Audit Event Reporter | The system that is reporting the event. | Since multi-tier, distributed, or composite applications make source identification ambiguous, this collection of fields may repeat for each application or process actively involved in the event. For example, multiple value-sets can identify participating web servers, application processes, and database server threads in an n-tier distributed application. Passive event participants (e.g. low-level network transports) need not be identified. |
source.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
source.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
source.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
source.site | Logical source location within the enterprise | Logical source location within the healthcare enterprise network. For example, a hospital or other provider location within a multi-entity provider group. | |
source.observer | The identity of source detecting the event | Identifier of the source where the event was detected. | |
source.type | The type of source where event originated | Code specifying the type of source where event originated. | |
entity | Data or objects used | Specific instances of data or objects that have been accessed. | Required unless the values for event identification, agent identification, and audit source identification are sufficient to document the entire auditable event. Because events may have more than one entity, this group can be a repeating set of values. |
entity.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
entity.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.what | Specific instance of resource | Identifies a specific instance of the entity. The reference should be version specific. | |
entity.type | Type of entity involved | The type of the object that was involved in this audit event. | This value is distinct from the user's role or any user relationship to the entity. |
entity.role | What role the entity played | Code representing the role the entity played in the event being audited. | |
entity.lifecycle | Life-cycle stage for the entity | Identifier for the data life-cycle stage for the entity. | This can be used to provide an audit trail for data, over time, as it passes through the system. |
entity.securityLabel | Security labels on the entity | Security labels for the identified entity. | Copied from entity meta security tags. |
entity.name | Descriptor for entity | A name of the entity in the audit event. | This field may be used in a query/report to identify audit events for a specific person. For example, where multiple synonymous entity identifiers (patient number, medical record number, encounter number, etc.) have been used. |
entity.description | Descriptive text | Text that describes the entity in more detail. | |
entity.query | Query parameters | The query parameters for a query-type entities. | The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example, if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob. |
entity.detail | Additional Information about the entity | Tagged value pairs for conveying additional information about the entity. | |
entity.detail.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
entity.detail.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.detail.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.detail.type | Name of the property | The type of extra detail provided in the value. | |
entity.detail.value[x] | Property value | The value of the extra detail. | The value can be string when known to be a string, else base64 encoding should be used to protect binary or undefined content. The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob. |
The audit event is based on the IHE-ATNA Audit record definitions, originally from RFC 3881, and now managed by DICOM (see DICOM Part 15 Annex A5).
This resource is managed collaboratively between HL7, DICOM, and IHE.
The primary purpose of this resource is the maintenance of security audit log information. However, it can also be used for any audit logging needs and simple event-based notification.
All actors - such as applications, processes, and services - involved in an auditable event should record an AuditEvent. This will likely result in multiple AuditEvent entries that show whether privacy and security safeguards, such as access control, are properly functioning across an enterprise's system-of-systems. Thus, it is typical to get an auditable event recorded by both the application in a workflow process and the servers that support them. For this reason, duplicate entries are expected, which is helpful because it may aid in the detection of. For example, fewer than expected actors being recorded in a multi-actor process or attributes related to those records being in conflict, which is an indication of a security problem. There may be non-participating actors, such as trusted intermediary, that also detect a security relevant event and thus would record an AuditEvent, such as a trusted intermediary.
Security relevant events are not limited to communications or RESTful events. They include:
See the Audit Event Sub-Type vocabulary for guidance on some security relevant events.
The content of an AuditEvent is intended for use by security system administrators, security and privacy information managers, and records management personnel. This content is not intended to be accessible or used directly by other healthcare users, such as providers or patients, although reports generated from the raw data would be useful. An example is a patient-centric accounting of disclosures or an access report. Servers that provide support for AuditEvent resources would not generally accept update or delete operations on the resources, as this would compromise the integrity of the audit record. Access to the AuditEvent would typically be limited to security, privacy, or other system administration purposes.
Relationship of AuditEvent and Provenance resources are often (though not exclusively) created by the application responding to the create/read/query/update/delete/execute etc. event. A Provenance resource contains overlapping information, but is a record-keeping assertion that gathers information about the context in which the information in a resource "came to be" in its current state, e.g., whether it was created de novo or obtained from another entity in whole, part, or by transformation. Provenance resources are prepared by the application that initiates the create/update of the resource and may be persisted with the AuditEvent target resource.
The AuditEvent resource and the ATNA Audit record are used in many contexts throughout healthcare. The coded values defined in the "extensible" bindings above are those widely used and/or defined by DICOM, IHE or ISO, who defined these codes to meet very specific use cases. These codes should be used when they are suitable. When needed, other codes can be defined.
Note: When using codes from a vocabulary, the display
element for the code can be left off to keep the
AuditEvent size small and minimize impact of a large audit log of similar entries.
The set of codes defined for this resource is expected to grow over time, and additional codes may be proposed / requested using the "Propose a change" link above below.
This table summarizes common event scenarios, and the codes that should be used for each case.
Scenario | type | subtype | action | Other |
User Login (example) | 110114 User Authentication | 110122 User Authentication | E Execute | One agent which contains the details of the logged-in user. |
User Logout (example) | 110114 User Authentication | 110123 User Logout | E Execute | One agent which contains the details of the logged-out user. |
REST operation logged on server (example) | rest RESTful Operation | [code] defined for operation | * (see below) | Agent for logged in user, if available. |
Search operation logged on server (example) | rest RESTful Operation | [code] defined for operation | E Execute | Agent for logged in user, if available, and one object with a query element. |
Audit Event Actions for RESTful operations:
Operation | Action |
create | C |
read, vread, history-instance, history-type, history-system | R |
update | U |
delete | D |
transaction, operation, conformance, validate, search, search-type, search-system | E |
FHIR interactions can result in a rich description of the outcome using the OperationOutcome. The OperationOutcome Resource is a collection of error, warning or information messages that result from a system action. This describes in detail the outcome of some operation, such as when a RESTful operation fails.
When recording into an AuditEvent that some FHIR interaction has happened, the AuditEvent should include the OperationOutcome from that FHIR interaction. This is done by placing the OperationOutcome into an AuditEvent.entity. Likely as a contained resource, given that OperationOutcome resources often are not persisted.
entity.who
is the OperationOutcome -- Likely contained
entity.type
is code
OperationOutcome
entity.description
explains why this OperationOutcome was included.
See transaction failure example: When a client attempts to post (create) an Observation
Resource,
using a server Patient
endpoint;
this would result in an error with an OperationOutcome.
The AuditEvent provides the element purposeOfEvent
to convey the purpose of the event and purposeOfUse
to convey the reason that a particular actor (machine, person, software) was involved in the event.
purposeOfEvent
is an element at the level of AuditEvent and can convey the purpose of the activity
that resulted in the event. This will occur when the system that is reporting the event is aware
of the purpose of the event. A specific example would be a radiology reporting system where a
radiologist has created and is sending a finished report. This system likely knows the purpose,
e.g., "treatment". It is multi-valued because the one event may be related to multiple purposes.
It is also commonplace that the reporting system does not have information about the purpose of the event. In these cases, the event report would not have a purposeOfEvent.
It is also likely that the same event will be reported from different perspectives, e.g., by both the
sender and recipient of a communication. These two different perspectives can have different
knowledge regarding the purposeOfEvent
.
purposeOfUse
is an element at the level of agent
within AuditEvent. This describes the reason that this
person, machine, or software is participating in the activity that resulted in the event. For
example, an individual person participating in the event may assert a purpose of use from their perspective.
It is also possible that they are participating for multiple reasons and report multiple purposeOfUse.
The reporting system might not have knowledge regarding why a particular machine or person was involved and would omit this element in those cases.
When the same event is reported from multiple perspectives, the reports can have different knowledge regarding the purpose.
action | Type of action performed during the event | AuditEvent.action |
address | Identifier for the network access point of the user device | AuditEvent.agent.network.address |
agent | Identifier of who | AuditEvent.agent.who |
agent-name | Human friendly name for the agent | AuditEvent.agent.name |
agent-role | Agent role in the event | AuditEvent.agent.role |
altid | Alternative User identity | AuditEvent.agent.altId |
date | Time when the event was recorded | AuditEvent.recorded |
entity | Specific instance of resource | AuditEvent.entity.what |
entity-name | Descriptor for entity | AuditEvent.entity.name |
entity-role | What role the entity played | AuditEvent.entity.role |
entity-type | Type of entity involved | AuditEvent.entity.type |
outcome | Whether the event succeeded or failed | AuditEvent.outcome |
patient | Identifier of who | AuditEvent.agent.who.where(resolve() is Patient) | AuditEvent.entity.what.where(resolve() is Patient) |
policy | Policy that authorized event | AuditEvent.agent.policy |
site | Logical source location within the enterprise | AuditEvent.source.site |
source | The identity of source detecting the event | AuditEvent.source.observer |
subtype | More specific type/id for the event | AuditEvent.subtype |
type | Type/identifier of event | AuditEvent.type |
Defines the elements to be supported within the AuditEvent resource in order to conform with the Electronic Health Record System Functional Model Record Lifecycle Event standard
Path | Short | Definition | Comments |
---|---|---|---|
Event record kept for security purposes | A record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage. | Based on IHE-ATNA. | |
type | Type/identifier of event | Identifier for a family of the event. For example, a menu item, program, rule, policy, function code, application name or URL. It identifies the performed function. | |
subtype | More specific type/id for the event | Identifier for the category of event. | |
action | Type of action performed during the event | Indicator for type of action performed during the event that generated the audit. | |
period | When the activity occurred | The period during which the activity occurred. | The period can be a little arbitrary; where possible, the time should correspond to human assessment of the activity time. |
recorded | Time when the event was recorded | The time when the event was recorded. | In a distributed system, some sort of common time base (e.g. an NTP [RFC1305] server) is a good implementation tactic. |
outcome | Whether the event succeeded or failed | Indicates whether the event succeeded or failed. | In some cases a "success" may be partial, for example, an incomplete or interrupted transfer of a radiological study. For the purpose of establishing accountability, these distinctions are not relevant. |
outcomeDesc | Description of the event outcome | A free text description of the outcome of the event. | |
purposeOfEvent | The purposeOfUse of the event | The purposeOfUse (reason) that was used during the event being recorded. | Use AuditEvent.agent.purposeOfUse when you know that it is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why. |
agent | Actor involved in the event | An actor taking an active role in the event or activity that is logged. | Several agents may be associated (i.e. have some responsibility for an activity) with an event or activity. For example, an activity may be initiated by one user for other users or involve more than one user. However, only one user may be the initiator/requestor for the activity. |
agent.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
agent.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.type | How agent participated | Specification of the participation type the user plays when performing the event. | |
agent.role | Agent role in the event | The security role that the user was acting under, that come from local codes defined by the access control security system (e.g. RBAC, ABAC) used in the local context. | Should be roles relevant to the event. Should not be an exhaustive list of roles. |
agent.who | Identifier of who | Reference to who this agent is that was involved in the event. | Where a User ID is available it will go into who.identifier. |
agent.altId | Alternative User identity | Alternative agent Identifier. For a human, this should be a user identifier text string from authentication system. This identifier would be one known to a common authentication system (e.g. single sign-on), if available. | |
agent.name | Human friendly name for the agent | Human-meaningful name for the agent. | |
agent.requestor | Whether user is initiator | Indicator that the user is or is not the requestor, or initiator, for the event being audited. | There can only be one initiator. If the initiator is not clear, then do not choose any one agent as the initiator. |
agent.location | Where | Where the event occurred. | |
agent.policy | Policy that authorized event | The policy or plan that authorized the activity being recorded. Typically, a single activity may have multiple applicable policies, such as patient consent, guarantor funding, etc. The policy would also indicate the security token used. | For example: Where an OAuth token authorizes, the unique identifier from the OAuth token is placed into the policy element Where a policy engine (e.g. XACML) holds policy logic, the unique policy identifier is placed into the policy element. |
agent.media | Type of media | Type of media involved. Used when the event is about exporting/importing onto media. | |
agent.network | Logical network location for application activity | Logical network location for application activity, if the activity has a network location. | |
agent.network.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
agent.network.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.network.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
agent.network.address | Identifier for the network access point of the user device | An identifier for the network access point of the user device for the audit event. | This could be a device id, IP address or some other identifier associated with a device. |
agent.network.type | The type of network access point | An identifier for the type of network access point that originated the audit event. | |
agent.purposeOfUse | Reason given for this user | The reason (purpose of use), specific to this agent, that was used during the event being recorded. | Use AuditEvent.agent.purposeOfUse when you know that is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why. |
source | Audit Event Reporter | The system that is reporting the event. | Since multi-tier, distributed, or composite applications make source identification ambiguous, this collection of fields may repeat for each application or process actively involved in the event. For example, multiple value-sets can identify participating web servers, application processes, and database server threads in an n-tier distributed application. Passive event participants (e.g. low-level network transports) need not be identified. |
source.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
source.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
source.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
source.site | Logical source location within the enterprise | Logical source location within the healthcare enterprise network. For example, a hospital or other provider location within a multi-entity provider group. | |
source.observer | The identity of source detecting the event | Identifier of the source where the event was detected. | |
source.type | The type of source where event originated | Code specifying the type of source where event originated. | |
entity | Data or objects used | Specific instances of data or objects that have been accessed. | Required unless the values for event identification, agent identification, and audit source identification are sufficient to document the entire auditable event. Because events may have more than one entity, this group can be a repeating set of values. |
entity.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
entity.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.what | Specific instance of resource | Identifies a specific instance of the entity. The reference should be version specific. | |
entity.type | Type of entity involved | The type of the object that was involved in this audit event. | This value is distinct from the user's role or any user relationship to the entity. |
entity.role | What role the entity played | Code representing the role the entity played in the event being audited. | |
entity.lifecycle | Life-cycle stage for the entity | Identifier for the data life-cycle stage for the entity. | This can be used to provide an audit trail for data, over time, as it passes through the system. |
entity.securityLabel | Security labels on the entity | Security labels for the identified entity. | Copied from entity meta security tags. |
entity.name | Descriptor for entity | A name of the entity in the audit event. | This field may be used in a query/report to identify audit events for a specific person. For example, where multiple synonymous entity identifiers (patient number, medical record number, encounter number, etc.) have been used. |
entity.description | Descriptive text | Text that describes the entity in more detail. | |
entity.query | Query parameters | The query parameters for a query-type entities. | The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example, if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob. |
entity.detail | Additional Information about the entity | Tagged value pairs for conveying additional information about the entity. | |
entity.detail.id | Unique id for inter-element referencing | Unique id for the element within a resource (for internal references). This may be any string value that does not contain spaces. | |
entity.detail.extension | Additional content defined by implementations | May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.detail.modifierExtension | Extensions that cannot be ignored even if unrecognized | May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself). | There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone. |
entity.detail.type | Name of the property | The type of extra detail provided in the value. | |
entity.detail.value[x] | Property value | The value of the extra detail. | The value can be string when known to be a string, else base64 encoding should be used to protect binary or undefined content. The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob. |