Resource type: auditevent

Description

A record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage.

Elements

PathShortDefinitionComments
Event record kept for security purposesA record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage.Based on IHE-ATNA.
typeType/identifier of eventIdentifier for a family of the event. For example, a menu item, program, rule, policy, function code, application name or URL. It identifies the performed function.
subtypeMore specific type/id for the eventIdentifier for the category of event.
actionType of action performed during the eventIndicator for type of action performed during the event that generated the audit.
periodWhen the activity occurredThe period during which the activity occurred.The period can be a little arbitrary; where possible, the time should correspond to human assessment of the activity time.
recordedTime when the event was recordedThe time when the event was recorded.In a distributed system, some sort of common time base (e.g. an NTP [RFC1305] server) is a good implementation tactic.
outcomeWhether the event succeeded or failedIndicates whether the event succeeded or failed.In some cases a "success" may be partial, for example, an incomplete or interrupted transfer of a radiological study. For the purpose of establishing accountability, these distinctions are not relevant.
outcomeDescDescription of the event outcomeA free text description of the outcome of the event.
purposeOfEventThe purposeOfUse of the eventThe purposeOfUse (reason) that was used during the event being recorded.Use AuditEvent.agent.purposeOfUse when you know that it is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
agentActor involved in the eventAn actor taking an active role in the event or activity that is logged.Several agents may be associated (i.e. have some responsibility for an activity) with an event or activity. For example, an activity may be initiated by one user for other users or involve more than one user. However, only one user may be the initiator/requestor for the activity.
agent.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
agent.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.typeHow agent participatedSpecification of the participation type the user plays when performing the event.
agent.roleAgent role in the eventThe security role that the user was acting under, that come from local codes defined by the access control security system (e.g. RBAC, ABAC) used in the local context.Should be roles relevant to the event. Should not be an exhaustive list of roles.
agent.whoIdentifier of whoReference to who this agent is that was involved in the event.Where a User ID is available it will go into who.identifier.
agent.altIdAlternative User identityAlternative agent Identifier. For a human, this should be a user identifier text string from authentication system. This identifier would be one known to a common authentication system (e.g. single sign-on), if available.
agent.nameHuman friendly name for the agentHuman-meaningful name for the agent.
agent.requestorWhether user is initiatorIndicator that the user is or is not the requestor, or initiator, for the event being audited.There can only be one initiator. If the initiator is not clear, then do not choose any one agent as the initiator.
agent.locationWhereWhere the event occurred.
agent.policyPolicy that authorized eventThe policy or plan that authorized the activity being recorded. Typically, a single activity may have multiple applicable policies, such as patient consent, guarantor funding, etc. The policy would also indicate the security token used.For example: Where an OAuth token authorizes, the unique identifier from the OAuth token is placed into the policy element Where a policy engine (e.g. XACML) holds policy logic, the unique policy identifier is placed into the policy element.
agent.mediaType of mediaType of media involved. Used when the event is about exporting/importing onto media.
agent.networkLogical network location for application activityLogical network location for application activity, if the activity has a network location.
agent.network.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
agent.network.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.network.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.network.addressIdentifier for the network access point of the user deviceAn identifier for the network access point of the user device for the audit event.This could be a device id, IP address or some other identifier associated with a device.
agent.network.typeThe type of network access pointAn identifier for the type of network access point that originated the audit event.
agent.purposeOfUseReason given for this userThe reason (purpose of use), specific to this agent, that was used during the event being recorded.Use AuditEvent.agent.purposeOfUse when you know that is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
sourceAudit Event ReporterThe system that is reporting the event.Since multi-tier, distributed, or composite applications make source identification ambiguous, this collection of fields may repeat for each application or process actively involved in the event. For example, multiple value-sets can identify participating web servers, application processes, and database server threads in an n-tier distributed application. Passive event participants (e.g. low-level network transports) need not be identified.
source.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
source.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
source.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
source.siteLogical source location within the enterpriseLogical source location within the healthcare enterprise network. For example, a hospital or other provider location within a multi-entity provider group.
source.observerThe identity of source detecting the eventIdentifier of the source where the event was detected.
source.typeThe type of source where event originatedCode specifying the type of source where event originated.
entityData or objects usedSpecific instances of data or objects that have been accessed.Required unless the values for event identification, agent identification, and audit source identification are sufficient to document the entire auditable event. Because events may have more than one entity, this group can be a repeating set of values.
entity.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
entity.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.whatSpecific instance of resourceIdentifies a specific instance of the entity. The reference should be version specific.
entity.typeType of entity involvedThe type of the object that was involved in this audit event.This value is distinct from the user's role or any user relationship to the entity.
entity.roleWhat role the entity playedCode representing the role the entity played in the event being audited.
entity.lifecycleLife-cycle stage for the entityIdentifier for the data life-cycle stage for the entity.This can be used to provide an audit trail for data, over time, as it passes through the system.
entity.securityLabelSecurity labels on the entitySecurity labels for the identified entity.Copied from entity meta security tags.
entity.nameDescriptor for entityA name of the entity in the audit event.This field may be used in a query/report to identify audit events for a specific person. For example, where multiple synonymous entity identifiers (patient number, medical record number, encounter number, etc.) have been used.
entity.descriptionDescriptive textText that describes the entity in more detail.
entity.queryQuery parametersThe query parameters for a query-type entities.The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example, if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.
entity.detailAdditional Information about the entityTagged value pairs for conveying additional information about the entity.
entity.detail.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
entity.detail.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.detail.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.detail.typeName of the propertyThe type of extra detail provided in the value.
entity.detail.value[x]Property valueThe value of the extra detail.The value can be string when known to be a string, else base64 encoding should be used to protect binary or undefined content. The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.

Scope and Usage

The audit event is based on the IHE-ATNA Audit record definitions, originally from RFC 3881, and now managed by DICOM (see DICOM Part 15 Annex A5).

This resource is managed collaboratively between HL7, DICOM, and IHE.

The primary purpose of this resource is the maintenance of security audit log information. However, it can also be used for any audit logging needs and simple event-based notification.

Background and Context

All actors - such as applications, processes, and services - involved in an auditable event should record an AuditEvent. This will likely result in multiple AuditEvent entries that show whether privacy and security safeguards, such as access control, are properly functioning across an enterprise's system-of-systems. Thus, it is typical to get an auditable event recorded by both the application in a workflow process and the servers that support them. For this reason, duplicate entries are expected, which is helpful because it may aid in the detection of. For example, fewer than expected actors being recorded in a multi-actor process or attributes related to those records being in conflict, which is an indication of a security problem. There may be non-participating actors, such as trusted intermediary, that also detect a security relevant event and thus would record an AuditEvent, such as a trusted intermediary.

Security relevant events are not limited to communications or RESTful events. They include:

See the Audit Event Sub-Type vocabulary for guidance on some security relevant events.

The content of an AuditEvent is intended for use by security system administrators, security and privacy information managers, and records management personnel. This content is not intended to be accessible or used directly by other healthcare users, such as providers or patients, although reports generated from the raw data would be useful. An example is a patient-centric accounting of disclosures or an access report. Servers that provide support for AuditEvent resources would not generally accept update or delete operations on the resources, as this would compromise the integrity of the audit record. Access to the AuditEvent would typically be limited to security, privacy, or other system administration purposes.

Relationship of AuditEvent and Provenance resources are often (though not exclusively) created by the application responding to the create/read/query/update/delete/execute etc. event. A Provenance resource contains overlapping information, but is a record-keeping assertion that gathers information about the context in which the information in a resource "came to be" in its current state, e.g., whether it was created de novo or obtained from another entity in whole, part, or by transformation. Provenance resources are prepared by the application that initiates the create/update of the resource and may be persisted with the AuditEvent target resource.

Using Coded Values

The AuditEvent resource and the ATNA Audit record are used in many contexts throughout healthcare. The coded values defined in the "extensible" bindings above are those widely used and/or defined by DICOM, IHE or ISO, who defined these codes to meet very specific use cases. These codes should be used when they are suitable. When needed, other codes can be defined.

Note: When using codes from a vocabulary, the display element for the code can be left off to keep the AuditEvent size small and minimize impact of a large audit log of similar entries.

The set of codes defined for this resource is expected to grow over time, and additional codes may be proposed / requested using the "Propose a change" link above below.

Event codes for Common Scenarios

This table summarizes common event scenarios, and the codes that should be used for each case.

Scenario type subtype action Other
User Login (example) 110114 User Authentication 110122 User Authentication E Execute One agent which contains the details of the logged-in user.
User Logout (example) 110114 User Authentication 110123 User Logout E Execute One agent which contains the details of the logged-out user.
REST operation logged on server (example) rest RESTful Operation [code] defined for operation * (see below) Agent for logged in user, if available.
Search operation logged on server (example) rest RESTful Operation [code] defined for operation E Execute Agent for logged in user, if available, and one object with a query element.

Audit Event Actions for RESTful operations:

Operation Action
create C
read, vread, history-instance, history-type, history-system R
update U
delete D
transaction, operation, conformance, validate, search, search-type, search-system E

Encoding a FHIR operation outcome

FHIR interactions can result in a rich description of the outcome using the OperationOutcome. The OperationOutcome Resource is a collection of error, warning or information messages that result from a system action. This describes in detail the outcome of some operation, such as when a RESTful operation fails.

When recording into an AuditEvent that some FHIR interaction has happened, the AuditEvent should include the OperationOutcome from that FHIR interaction. This is done by placing the OperationOutcome into an AuditEvent.entity. Likely as a contained resource, given that OperationOutcome resources often are not persisted.

entity.who is the OperationOutcome -- Likely contained

entity.type is code OperationOutcome

entity.description explains why this OperationOutcome was included.

See transaction failure example: When a client attempts to post (create) an Observation Resource, using a server Patient endpoint; this would result in an error with an OperationOutcome.

PurposeOfEvent and PurposeOfUse

The AuditEvent provides the element purposeOfEvent to convey the purpose of the event and purposeOfUse to convey the reason that a particular actor (machine, person, software) was involved in the event.

purposeOfEvent is an element at the level of AuditEvent and can convey the purpose of the activity that resulted in the event. This will occur when the system that is reporting the event is aware of the purpose of the event. A specific example would be a radiology reporting system where a radiologist has created and is sending a finished report. This system likely knows the purpose, e.g., "treatment". It is multi-valued because the one event may be related to multiple purposes.

It is also commonplace that the reporting system does not have information about the purpose of the event. In these cases, the event report would not have a purposeOfEvent.

It is also likely that the same event will be reported from different perspectives, e.g., by both the sender and recipient of a communication. These two different perspectives can have different knowledge regarding the purposeOfEvent.

purposeOfUse is an element at the level of agent within AuditEvent. This describes the reason that this person, machine, or software is participating in the activity that resulted in the event. For example, an individual person participating in the event may assert a purpose of use from their perspective. It is also possible that they are participating for multiple reasons and report multiple purposeOfUse.

The reporting system might not have knowledge regarding why a particular machine or person was involved and would omit this element in those cases.

When the same event is reported from multiple perspectives, the reports can have different knowledge regarding the purpose.

Search Parameters

actionType of action performed during the eventAuditEvent.action
addressIdentifier for the network access point of the user deviceAuditEvent.agent.network.address
agentIdentifier of whoAuditEvent.agent.who
agent-nameHuman friendly name for the agentAuditEvent.agent.name
agent-roleAgent role in the eventAuditEvent.agent.role
altidAlternative User identityAuditEvent.agent.altId
dateTime when the event was recordedAuditEvent.recorded
entitySpecific instance of resourceAuditEvent.entity.what
entity-nameDescriptor for entityAuditEvent.entity.name
entity-roleWhat role the entity playedAuditEvent.entity.role
entity-typeType of entity involvedAuditEvent.entity.type
outcomeWhether the event succeeded or failedAuditEvent.outcome
patientIdentifier of whoAuditEvent.agent.who.where(resolve() is Patient) | AuditEvent.entity.what.where(resolve() is Patient)
policyPolicy that authorized eventAuditEvent.agent.policy
siteLogical source location within the enterpriseAuditEvent.source.site
sourceThe identity of source detecting the eventAuditEvent.source.observer
subtypeMore specific type/id for the eventAuditEvent.subtype
typeType/identifier of eventAuditEvent.type

Extension Definitions

These are extension definitions for this resource defined by the spec

Profiles based on this resource

EHRS FM Record Lifecycle Event - Audit Event

Defines the elements to be supported within the AuditEvent resource in order to conform with the Electronic Health Record System Functional Model Record Lifecycle Event standard

Elements

PathShortDefinitionComments
Event record kept for security purposesA record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage.Based on IHE-ATNA.
typeType/identifier of eventIdentifier for a family of the event. For example, a menu item, program, rule, policy, function code, application name or URL. It identifies the performed function.
subtypeMore specific type/id for the eventIdentifier for the category of event.
actionType of action performed during the eventIndicator for type of action performed during the event that generated the audit.
periodWhen the activity occurredThe period during which the activity occurred.The period can be a little arbitrary; where possible, the time should correspond to human assessment of the activity time.
recordedTime when the event was recordedThe time when the event was recorded.In a distributed system, some sort of common time base (e.g. an NTP [RFC1305] server) is a good implementation tactic.
outcomeWhether the event succeeded or failedIndicates whether the event succeeded or failed.In some cases a "success" may be partial, for example, an incomplete or interrupted transfer of a radiological study. For the purpose of establishing accountability, these distinctions are not relevant.
outcomeDescDescription of the event outcomeA free text description of the outcome of the event.
purposeOfEventThe purposeOfUse of the eventThe purposeOfUse (reason) that was used during the event being recorded.Use AuditEvent.agent.purposeOfUse when you know that it is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
agentActor involved in the eventAn actor taking an active role in the event or activity that is logged.Several agents may be associated (i.e. have some responsibility for an activity) with an event or activity. For example, an activity may be initiated by one user for other users or involve more than one user. However, only one user may be the initiator/requestor for the activity.
agent.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
agent.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.typeHow agent participatedSpecification of the participation type the user plays when performing the event.
agent.roleAgent role in the eventThe security role that the user was acting under, that come from local codes defined by the access control security system (e.g. RBAC, ABAC) used in the local context.Should be roles relevant to the event. Should not be an exhaustive list of roles.
agent.whoIdentifier of whoReference to who this agent is that was involved in the event.Where a User ID is available it will go into who.identifier.
agent.altIdAlternative User identityAlternative agent Identifier. For a human, this should be a user identifier text string from authentication system. This identifier would be one known to a common authentication system (e.g. single sign-on), if available.
agent.nameHuman friendly name for the agentHuman-meaningful name for the agent.
agent.requestorWhether user is initiatorIndicator that the user is or is not the requestor, or initiator, for the event being audited.There can only be one initiator. If the initiator is not clear, then do not choose any one agent as the initiator.
agent.locationWhereWhere the event occurred.
agent.policyPolicy that authorized eventThe policy or plan that authorized the activity being recorded. Typically, a single activity may have multiple applicable policies, such as patient consent, guarantor funding, etc. The policy would also indicate the security token used.For example: Where an OAuth token authorizes, the unique identifier from the OAuth token is placed into the policy element Where a policy engine (e.g. XACML) holds policy logic, the unique policy identifier is placed into the policy element.
agent.mediaType of mediaType of media involved. Used when the event is about exporting/importing onto media.
agent.networkLogical network location for application activityLogical network location for application activity, if the activity has a network location.
agent.network.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
agent.network.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.network.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
agent.network.addressIdentifier for the network access point of the user deviceAn identifier for the network access point of the user device for the audit event.This could be a device id, IP address or some other identifier associated with a device.
agent.network.typeThe type of network access pointAn identifier for the type of network access point that originated the audit event.
agent.purposeOfUseReason given for this userThe reason (purpose of use), specific to this agent, that was used during the event being recorded.Use AuditEvent.agent.purposeOfUse when you know that is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
sourceAudit Event ReporterThe system that is reporting the event.Since multi-tier, distributed, or composite applications make source identification ambiguous, this collection of fields may repeat for each application or process actively involved in the event. For example, multiple value-sets can identify participating web servers, application processes, and database server threads in an n-tier distributed application. Passive event participants (e.g. low-level network transports) need not be identified.
source.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
source.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
source.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
source.siteLogical source location within the enterpriseLogical source location within the healthcare enterprise network. For example, a hospital or other provider location within a multi-entity provider group.
source.observerThe identity of source detecting the eventIdentifier of the source where the event was detected.
source.typeThe type of source where event originatedCode specifying the type of source where event originated.
entityData or objects usedSpecific instances of data or objects that have been accessed.Required unless the values for event identification, agent identification, and audit source identification are sufficient to document the entire auditable event. Because events may have more than one entity, this group can be a repeating set of values.
entity.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
entity.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.whatSpecific instance of resourceIdentifies a specific instance of the entity. The reference should be version specific.
entity.typeType of entity involvedThe type of the object that was involved in this audit event.This value is distinct from the user's role or any user relationship to the entity.
entity.roleWhat role the entity playedCode representing the role the entity played in the event being audited.
entity.lifecycleLife-cycle stage for the entityIdentifier for the data life-cycle stage for the entity.This can be used to provide an audit trail for data, over time, as it passes through the system.
entity.securityLabelSecurity labels on the entitySecurity labels for the identified entity.Copied from entity meta security tags.
entity.nameDescriptor for entityA name of the entity in the audit event.This field may be used in a query/report to identify audit events for a specific person. For example, where multiple synonymous entity identifiers (patient number, medical record number, encounter number, etc.) have been used.
entity.descriptionDescriptive textText that describes the entity in more detail.
entity.queryQuery parametersThe query parameters for a query-type entities.The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example, if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.
entity.detailAdditional Information about the entityTagged value pairs for conveying additional information about the entity.
entity.detail.idUnique id for inter-element referencingUnique id for the element within a resource (for internal references). This may be any string value that does not contain spaces.
entity.detail.extensionAdditional content defined by implementationsMay be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.detail.modifierExtensionExtensions that cannot be ignored even if unrecognizedMay be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions. Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
entity.detail.typeName of the propertyThe type of extra detail provided in the value.
entity.detail.value[x]Property valueThe value of the extra detail.The value can be string when known to be a string, else base64 encoding should be used to protect binary or undefined content. The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.