This page is part of the FHIR Specification (v4.0.1: R4 (v5.0.0: R5 - Mixed Normative and STU ) ). This is the current published version in it's permanent home (it will always be available at this URL). The current version which supercedes this version is 5.0.0 . For a full list of available versions, see the Directory of published versions . Page versions: R5 R4B R4 R3 R2

• Content
• Examples
• Detailed Descriptions
• Mappings
• Operations
• Search Params
• Profiles &
• Extensions
• R3 R4 Conversions

6.4.7 6.4.8 Resource AuditEvent - Mappings

Security Work Group

Maturity Level : N/A

Standards Status : Informative

Security Category : Not Classified

Compartments : Device , Patient , Practitioner

Mappings for the auditevent resource (see Mappings to Other Standards for further information & status).

6.4.7.1 6.4.8.1 FiveWs Pattern Mapping ( http://hl7.org/fhir/fivews )

AuditEvent	infrastructure.information
type     category	FiveWs.what[x]
subtype     code	FiveWs.what[x]
action	FiveWs.what[x]
period     occurred[x]	FiveWs.done[x]
recorded	FiveWs.recorded
outcome	FiveWs.what[x]
outcomeDesc         code	FiveWs.what[x]
purposeOfEvent         detail	FiveWs.why[x] FiveWs.what[x]
agent     authorization	FiveWs.who FiveWs.why[x]
type     basedOn	FiveWs.who FiveWs.why[x]
role     patient	FiveWs.who FiveWs.subject[x]
who     encounter	FiveWs.who FiveWs.why[x]
altId     agent	FiveWs.who
name         type	FiveWs.who
requestor         role	FiveWs.who
location FiveWs.where[x]         policy         who	FiveWs.why[x] FiveWs.who
media         requestor	FiveWs.where[x] FiveWs.who
network         location	FiveWs.where[x]
address         policy	FiveWs.where[x] FiveWs.why[x]
type         network[x]	FiveWs.where[x]
purposeOfUse         authorization	FiveWs.why[x]
source	FiveWs.witness
site	FiveWs.witness
observer	FiveWs.witness
type	FiveWs.witness
entity	FiveWs.what[x]
what	FiveWs.what[x]
type FiveWs.what[x]         role	FiveWs.context
lifecycle FiveWs.context         securityLabel	FiveWs.context
name FiveWs.context         description FiveWs.context         query	FiveWs.context
detail	FiveWs.context
type	FiveWs.context
value[x]	FiveWs.context

6.4.7.2 6.4.8.2 Workflow Pattern ( http://hl7.org/fhir/workflow )

AuditEvent	Event
type     category	Event.code
period     occurred[x]	Event.occurred[x] Event.occurrence
purposeOfEvent     authorization	Event.reasonCode Event.reason
basedOn	Event.code
patient	Event.subject
encounter	Event.code
agent	Event.performer
type	Event.performer.function
who	Event.performer.actor
location	Event.location

6.4.7.3 6.4.8.3 RIM Mapping ( http://hl7.org/v3 )

.actionNegationInd .participation .typeCode and/or .functionCode .role .id .id (distinguish id type by root) .name pre-coordinated into URL

AuditEvent	ControlAct[moodCode=EVN]
type     category	.code (type, subtype and action are pre-coordinated or sent as translations)
subtype     code	.code (type, subtype and action are pre-coordinated or sent as translations)
action	.code (type, subtype and action are pre-coordinated or sent as translations)
period     severity	N/A
occurred[x]	./effectiveTime[type=IVL_TS]
recorded	.effectiveTime
outcome	.outboundRelationship[typeCode=OUT].target.text
outcomeDesc         code	.outboundRelationship[typeCode=OUT].target.text
purposeOfEvent         detail	.outboundRelationship[typeCode=OUT].target.text
authorization	* .reasonCode [ControlActReason when Act.class = CACT Control Act] *.outboundRelationship[typeCode=RSON].target
agent     basedOn	Act.code
type     patient	participation[typeCode=RTGT]
role     encounter	Act.code
who     agent	.participation
altId         type	.typeCode and/or .functionCode
name         role	.role
who	.id
requestor	If participation.typeCode was author, then true
location	* Role.Class =SDLOC *Role.Code = ServiceDeliveryLocationRoleType *Entity.Code = PlaceEntityType = df.Types of places for Entity.Class = PLC *EntityClass = PLC = df.A physical place or site with its containing structure. May be natural or man-made. The geographic position of a place might or might not be constant.
policy	ActPolicyType
media .player.description.mediaType         network .player.description.reference             address pre-coordinated into URL             type         network[x]	.player.description
purposeOfUse         authorization	*.reasonCode [ActHealthInformationPurposeOfUseReason codes/v:PurposeOfUse (2.16.840.1.113883.1.11.20448) * .outboundRelationship[typeCode=RSON or SUBJ].target
source	.participation[typeCode=INF].role[classCode=ASSIGN].player[classCode=DEV, determinerCode=INSTANCE]
site	.scopedRole[classCode=LOCE].player.desc
observer	.id
type	.code
entity	.outboundRelationship[typeCode=SUBJ].target or .participation[typeCode=SBJ].role
what	.id
type [self::Act].code or role.player.code         role	role.code (not sure what this would mean for an Act)
lifecycle target of ObservationEvent[code="lifecycle"].value         securityLabel	.confidentialityCode
name .title         description .text         query	No mapping
detail	.inboundRelationship[typeCode=SUBJ].target[classCode=OBS, moodCode=EVN]
type	.code
value[x]	.value
agent	./author/role

6.4.7.4 6.4.8.4 DICOM Tag Mapping ( http://nema.org/dicom )

AuditEvent	Message
type     category	EventId
subtype     code	EventTypeCode
action	EventActionCode
period     severity	EventDateTime PRI
recorded     occurred[x]
outcome     recorded	EventOutcomeIndicator EventDateTime
outcomeDesc     outcome	EventOutcomeDescription
purposeOfEvent         code	EventPurposeOfUse EventOutcomeIndicator EventOutcomeIndicator
agent         detail	ActiveParticipant
type     authorization	RoleIdCode EventPurposeOfUse
role     basedOn	RoleIdCode
who     patient	UserId
altId     encounter	AlternativeUserId
name     agent	UserName ActiveParticipant
requestor         type	UserIsRequestor prime RoleIdCode
location         role	all RoleIdCode
policy         who	ParticipantRoleIDCode UserName and UserId
media         requestor	MediaType UserIsRequestor
network         location
address         policy	NetworkAccessPointID ParticipantRoleIDCode
type         network[x]	NetworkAccessPointID and NetworkAccessPointTypeCode
purposeOfUse         authorization
source	AuditSourceIdentification
site	AuditEnterpriseSiteId
observer	AuditSourceId
type	AuditSourceTypeCode
entity	ParticipantObjectIdentification
what	ParticipantObjectTypeCode, ParticipantObjectName, ParticipantObjectID and ParticipantObjectIDTypeCode
type ParticipantObjectTypeCode         role	ParticipantObjectTypeCodeRole
lifecycle ParticipantObjectDataLifeCycle         securityLabel	ParticipantObjectSensitivity
name ParticipantObjectName         description         query	ParticipantObjectDescription ParticipantObjectQuery
query         detail	ParticipantObjectQuery ParticipantObjectDetail
detail             type	ParticipantObjectDetail ParticipantObjectDetail.type
type             value[x]	ParticipantObjectDetail.type ParticipantObjectDetail.value
value[x]         agent	ParticipantObjectDetail.value ActiveParticipant.MediaType

6.4.7.5 6.4.8.5 W3C PROV ( http://www.w3.org/ns/prov )

AuditEvent
type     category	Activity
subtype     code
action
period     severity	Activity.startTime & Activity.endTime
recorded     occurred[x]	Activity.when Activity.startTime & Activity.endTime
outcome     recorded	Activity.when
outcomeDesc     outcome
purposeOfEvent         code	Activity.Activity
agent         detail	Agent
type     authorization	Agent.Attribution Activity.Activity
role     basedOn	Agent.Attribution Activity.Activity
who     patient	Agent.Identity Entity.Identity
altId     encounter	Agent.Identity Activity.Activity
name     agent	Agent.Identity Agent
requestor         type	Agent.Attribution
location         role	Activity.location Agent.Attribution
policy         who	Agent.Identity
media         requestor
network         location	Activity.location
address         policy	Agent.Location
type         network[x]	Agent.Location
purposeOfUse         authorization	Agent.Activity
source
site
observer
type
entity	Entity
what
type Entity.type         role	Entity.role
lifecycle Entity.role         securityLabel
name Entity.Label         description         query
query         detail
detail             type
type             value[x]
value[x]         agent

6.4.7.6 6.4.8.6 FHIR Provenance Mapping ( http://hl7.org/fhir/provenance )

AuditEvent
type     category
subtype     code	Provenance.activity
action
period     severity	Provenance.occurred[x]
recorded     occurred[x]	Provenance.recorded Provenance.occurred[x]
outcome     recorded	Provenance.recorded
outcomeDesc     outcome
purposeOfEvent         code	Provenance.reason, Provenance.activity
agent         detail	Provenance.agent
type     authorization	Provenance.agent.type Provenance.authorization
role     basedOn	Provenance.agent.role
who     patient	Provenance.agent.who
altId     encounter
name     agent	Provenance.agent
requestor         type	Provenance.agent.type
location         role	Provenance.location Provenance.agent.role
policy         who	Provenance.policy Provenance.agent.who
media         requestor
network         location	Provenance.location
address         policy	Provenance.policy
type         network[x]
purposeOfUse         authorization
source
site
observer
type
entity	Provenance.target, Provenance.entity
what	Provenance.target, Provenance.entity.what
type Provenance.entity.type         role
lifecycle Provenance.entity.role         securityLabel
name         description         query
query         detail
detail             type
type             value[x]
value[x]         agent	Provenance.entity.agent