Release
4
5
Security
and
Privacy
This
page
is
part
of
the
FHIR
Specification
(v4.0.1:
R4
(v5.0.0:
R5
-
Mixed
Normative
and
STU
)
).
This
is
the
current
published
version
in
it's
permanent
home
(it
will
always
be
available
at
this
URL).
The
current
version
which
supercedes
this
version
is
5.0.0
.
For
a
full
list
of
available
versions,
see
the
Directory
of
published
versions
.
Page
versions:
R5
R4B
R4
R3
R2
|
Security
Work
Group
|
Maturity
Level
:
|
Trial Use | Security Category : Not Classified | Compartments : Device , Patient , Practitioner |
A
record
of
an
event
made
relevant
for
purposes
of
maintaining
a
security
log.
Typical
uses
include
detection
of
intrusion
attempts
such
as
operations,
privacy,
security,
maintenance,
and
monitoring
for
inappropriate
usage.
performance
analysis.
The
audit
event
is
based
on
the
IHE-ATNA
Audit
record
definitions,
originally
from
RFC
3881
,
and
now
managed
by
DICOM
(see
DICOM
Part
15
Annex
A5
).
This resource is managed collaboratively between HL7, DICOM, and IHE.
The
primary
purpose
of
this
resource
is
the
maintenance
A
record
of
security
audit
log
information.
However,
it
can
also
be
used
an
event
relevant
for
any
audit
logging
needs
purposes
such
as
operations,
privacy,
security,
maintenance,
and
simple
event-based
notification.
performance
analysis.
All
actors
-
such
as
applications,
processes,
and
services
-
involved
in
an
auditable
event
should
record
an
AuditEvent.
This
will
likely
result
in
multiple
AuditEvent
entries
that
show
whether
privacy
and
security
safeguards,
such
as
access
control,
are
properly
functioning
across
an
enterprise's
system-of-systems.
Thus,
it
is
typical
to
get
an
auditable
event
recorded
by
both
the
application
in
a
workflow
process
and
the
servers
that
support
them.
For
this
reason,
duplicate
entries
are
expected,
which
is
helpful
because
it
may
aid
in
the
detection
of.
of
security,
privacy,
or
other
operational
problems.
For
example,
fewer
than
expected
actors
being
recorded
in
a
multi-actor
process
or
attributes
related
to
those
records
being
in
conflict,
which
is
an
indication
of
a
security
problem.
There
may
be
non-participating
actors,
such
as
trusted
intermediary,
that
also
detect
a
security
security,
privacy,
or
operational
relevant
event
and
thus
would
record
an
AuditEvent,
such
as
a
trusted
intermediary.
AuditEvent.
Security relevant events are not limited to communications or RESTful events. They include:
See
the
Audit
Event
Sub-Type
Category
vocabulary
for
guidance
on
some
security
relevant
events.
event
categories.
The AuditEvent resource holds the details of an event in terms of who, what, where, when, and why. Where the identification of the who participated is the agent. An agent can be a person, an organization, software, device, or other actors that may be ascribed responsibility. What objects were used/created/updated is recorded as the entity. An entity is an identifiable physical, digital, conceptual or other kind of thing; entities may be real or imaginary.
The content of an AuditEvent is intended for use by security system administrators, security and privacy information managers, and records management personnel. This content is not intended to be accessible or used directly by other healthcare users, such as providers or patients, although reports generated from the raw data would be useful. An example is a patient-centric accounting of disclosures or an access report. Servers that provide support for AuditEvent resources would not generally accept update or delete operations on the resources, as this would compromise the integrity of the audit record. Access to the AuditEvent would typically be limited to security, privacy, or other system administration purposes.
Relationship of AuditEvent and Provenance resources are often (though not exclusively) created by the application responding to the create/read/query/update/delete/execute etc. event. A Provenance resource contains overlapping information, but is a record-keeping assertion that gathers information about the context in which the information in a resource "came to be" in its current state, e.g., whether it was created de novo or obtained from another entity in whole, part, or by transformation. Provenance resources are prepared by the application that initiates the create/update of the resource and may be persisted with the AuditEvent target resource.
Structure
| Name | Flags | Card. | Type |
Description
&
Constraints
|
|---|---|---|---|---|
AuditEvent
|
TU | DomainResource |
Elements defined in Ancestors: id , meta , implicitRules , language , text , contained , extension , modifierExtension |
|
|
Σ |
|
|
Type/identifier
of
event
Binding: Audit Event ID ( |
|
|
Σ |
|
|
Binding: Audit Event Sub-Type ( |
action
|
Σ | 0..1 | code |
Type
of
action
performed
during
the
event
Binding: |
|
severity
|
Σ | 0..1 |
|
emergency
|
alert
|
critical
|
error
|
warning
|
notice
|
informational
|
debug
Binding: Audit Event Severity ( Required ) |
 
occurred[x]
| 0..1 |
When
the
activity
occurred
|
||
occurredPeriod
|
|
|||
occurredDateTime
|
|
|
||
|
|
Σ |
|
|
|
outcome
|
Σ | 0..1 |
|
|
|
|
Σ |
|
|
|
|
detail
|
Σ |
|
|
Binding: Audit Event Outcome Detail ( Example ) |
|
|
Σ |
|
CodeableConcept |
Binding: PurposeOfUse
|
basedOn
|
0..* |
|
|
|
|
|
|
0..1 |
Reference
(
|
|
|
encounter
|
0..1 |
|
|
|
|
agent
|
Σ |
|
|
|
|
type
|
|
|
Binding: Participation Role Type ( Preferred ) |
|
|
role
|
0..* |
|
Binding: Security Role Type ( |
|
|
who
|
Σ |
|
|
|
|
requestor
|
Σ | 0..1 |
|
|
|
location
|
0..1 |
|
|
|
|
|
|
|
|
|
|
network[x]
|
0..1 |
|
|
|
|
networkReference
|
Reference
(
|
|||
|
networkUri
| uri | |||
|
networkString
| string | |||
|
authorization
| 0..* | CodeableConcept |
Allowable
authorization
for
this
Binding: PurposeOfUse
|
|
|
source
|
Σ | 1..1 | BackboneElement |
Audit
Event
Reporter
|
|
site
|
0..1 |
|
Logical
source
location
within
the
enterprise
|
|
|
observer
|
Σ | 1..1 |
Reference
(
|
The
identity
of
source
detecting
the
event
|
|
type
|
0..* |
|
The
type
of
source
where
event
originated
Binding: Audit Event Source Type ( |
|
entity
|
|
0..* | BackboneElement |
Data
or
objects
used
|
what
|
Σ | 0..1 | Reference ( Any ) |
Specific
instance
of
resource
|
|
role
|
0..1 | CodeableConcept |
What
role
the
entity
played
Binding: Audit Event Entity Role ( Example ) |
|
|
securityLabel
|
|
|
|
|
|
query
|
Σ | 0..1 |
|
|
|
detail
|
|
|
|
|
|
|
|
|
|
|
|
value[x]
|
1..1 |
|
||
|
valueQuantity
|
Quantity | |||
|
valueCodeableConcept
|
CodeableConcept | |||
|
valueString
|
|
string | ||
|
|
|
|||
|
valueInteger
|
|
|||
|
valueRange
| Range | |||
|
valueRatio
|
|
|
||
|
|
|
|
||
|
valueDateTime
|
|
|||
|
valuePeriod
|
|
|||
|
valueBase64Binary
|
base64Binary | |||
agent
| 0..* | see agent |
Entity
is
attributed
to
this
agent
|
|
|
Documentation
for
this
format
|
||||
See the Extensions for this resource
UML Diagram ( Legend )
XML Template
<<AuditEvent xmlns="http://hl7.org/fhir"><!-- from Resource: id, meta, implicitRules, and language --> <!-- from DomainResource: text, contained, extension, and modifierExtension -->
<</type> <</subtype><category><!-- 0..* CodeableConcept Type/identifier of event --></category> <code><!-- 1..1 CodeableConcept Specific type of event --></code> <action value="[code]"/><!-- 0..1 Type of action performed during the event --><</period><severity value="[code]"/><!-- 0..1 emergency | alert | critical | error | warning | notice | informational | debug --> <occurred[x]><!-- 0..1 Period|dateTime When the activity occurred --></occurred[x]> <recorded value="[instant]"/><!-- 1..1 Time when the event was recorded -->< < <</purposeOfEvent><outcome> <!-- 0..1 Whether the event succeeded or failed --> <code><!-- 1..1 Coding Whether the event succeeded or failed --></code> <detail><!-- 0..* CodeableConcept Additional outcome detail --></detail> </outcome> <authorization><!-- 0..* CodeableConcept Authorization related to the event<</type> <</role> <| </who> < < < <</location> < <</media> < < < </network> <</purposeOfUse><type><!-- 0..1 CodeableConcept How agent participated --></type> <role><!-- 0..* CodeableConcept Agent role in the event --></role> <who><!-- 1..1 Reference(CareTeam|Device|Organization|Patient|Practitioner| PractitionerRole|RelatedPerson) Identifier of who --></who> <requestor value="[boolean]"/><!-- 0..1 Whether user is initiator --> <location><!-- 0..1 Reference(Location) The agent location when the event occurred --></location> <policy value="[uri]"/><!-- 0..* Policy that authorized the agent participation in the event --> <network[x]><!-- 0..1 Reference(Endpoint)|uri|string This agent network location for the activity --></network[x]> <authorization><!-- 0..* CodeableConcept Allowable authorization for this agent< < <| </observer> <</type><source> <!-- 1..1 Audit Event Reporter --> <site><!-- 0..1 Reference(Location) Logical source location within the enterprise --></site> <observer><!-- 1..1 Reference(CareTeam|Device|Organization|Patient|Practitioner| PractitionerRole|RelatedPerson) The identity of source detecting the event --></observer> <type><!-- 0..* CodeableConcept The type of source where event originated --></type> </source> <entity> <!-- 0..* Data or objects used --><</what> <</type> <</role> <</lifecycle> <</securityLabel> < < <<what><!-- 0..1 Reference(Any) Specific instance of resource --></what> <role><!-- 0..1 CodeableConcept What role the entity played --></role> <securityLabel><!-- 0..* CodeableConcept Security labels on the entity --></securityLabel> <query value="[base64Binary]"/><!-- 0..1 Query parameters --> <detail> <!-- 0..* Additional Information about the entity -->< <</value[x]><type><!-- 1..1 CodeableConcept Name of the property --></type> <value[x]><!-- 1..1 Quantity|CodeableConcept|string|boolean|integer|Range| Ratio|time|dateTime|Period|base64Binary Property value --></value[x]> </detail> <agent><!-- 0..* Content as for AuditEvent.agent Entity is attributed to this agent --></agent> </entity> </AuditEvent>
JSON Template
{
"resourceType" : "",
"resourceType" : "AuditEvent",
// from Resource: id, meta, implicitRules, and language
// from DomainResource: text, contained, extension, and modifierExtension
"
"
"category" : [{ CodeableConcept }], // Type/identifier of event
"code" : { CodeableConcept }, // R! Specific type of event
"action" : "<code>", // Type of action performed during the event
"
"severity" : "<code>", // emergency | alert | critical | error | warning | notice | informational | debug
// occurred[x]: When the activity occurred. One of these 2:
"occurredPeriod" : { Period },
"occurredDateTime" : "<dateTime>",
"recorded" : "<instant>", // R! Time when the event was recorded
"
"
"
"outcome" : { // Whether the event succeeded or failed
"code" : { Coding }, // R! Whether the event succeeded or failed
"detail" : [{ CodeableConcept }] // Additional outcome detail
},
"authorization" : [{ CodeableConcept }], // Authorization related to the event
"basedOn" : [{ Reference(CarePlan|DeviceRequest|ImmunizationRecommendation|
MedicationRequest|NutritionOrder|ServiceRequest|Task) }], // Workflow authorization within which this event occurred
"patient" : { Reference(Patient) }, // The patient is the subject of the data used/created/updated/deleted during the activity
"encounter" : { Reference(Encounter) }, // Encounter within which this event occurred or which the event is tightly associated
"agent" : [{ // R! Actor involved in the event
"
"
"|
"
"
"
"
"
"
"
"
"
},
"
"type" : { CodeableConcept }, // How agent participated
"role" : [{ CodeableConcept }], // Agent role in the event
"who" : { Reference(CareTeam|Device|Organization|Patient|Practitioner|
PractitionerRole|RelatedPerson) }, // R! Identifier of who
"requestor" : <boolean>, // Whether user is initiator
"location" : { Reference(Location) }, // The agent location when the event occurred
"policy" : ["<uri>"], // Policy that authorized the agent participation in the event
// network[x]: This agent network location for the activity. One of these 3:
"networkReference" : { Reference(Endpoint) },
"networkUri" : "<uri>",
"networkString" : "<string>",
"authorization" : [{ CodeableConcept }] // Allowable authorization for this agent
}],
"
"
"|
"
"source" : { // R! Audit Event Reporter
"site" : { Reference(Location) }, // Logical source location within the enterprise
"observer" : { Reference(CareTeam|Device|Organization|Patient|Practitioner|
PractitionerRole|RelatedPerson) }, // R! The identity of source detecting the event
"type" : [{ CodeableConcept }] // The type of source where event originated
},
"entity" : [{ // Data or objects used
"
"
"
"
"
"
"
"
"what" : { Reference(Any) }, // Specific instance of resource
"role" : { CodeableConcept }, // What role the entity played
"securityLabel" : [{ CodeableConcept }], // Security labels on the entity
"query" : "<base64Binary>", // Query parameters
"detail" : [{ // Additional Information about the entity
"
">"
"type" : { CodeableConcept }, // R! Name of the property
// value[x]: Property value. One of these 11:
"valueQuantity" : { Quantity },
"valueCodeableConcept" : { CodeableConcept },
"valueString" : "<string>",
"valueBoolean" : <boolean>,
"valueInteger" : <integer>,
"valueRange" : { Range },
"valueRatio" : { Ratio },
"valueTime" : "<time>",
"valueDateTime" : "<dateTime>",
"valuePeriod" : { Period },
"valueBase64Binary" : "<base64Binary>"
}]
}],
"agent" : [{ Content as for AuditEvent.agent }] // Entity is attributed to this agent
}]
}
Turtle Template
@prefix fhir: <http://hl7.org/fhir/> .[ a fhir:;[ a fhir:AuditEvent; fhir:nodeRole fhir:treeRoot; # if this is the parser root # from Resource: .id, .meta, .implicitRules, and .language # from DomainResource: .text, .contained, .extension, and .modifierExtensionfhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: ]; fhir: ], ...; fhir: fhir: fhir: fhir: ]; fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: # . One of these 2 fhir: ] fhir: ] ], ...; ], ...;fhir:category ( [ CodeableConcept ] ... ) ; # 0..* Type/identifier of event fhir:code [ CodeableConcept ] ; # 1..1 Specific type of event fhir:action [ code ] ; # 0..1 Type of action performed during the event fhir:severity [ code ] ; # 0..1 emergency | alert | critical | error | warning | notice | informational | debug # occurred[x] : 0..1 When the activity occurred. One of these 2 fhir:occurred [ a fhir:Period ; Period ] fhir:occurred [ a fhir:dateTime ; dateTime ] fhir:recorded [ instant ] ; # 1..1 Time when the event was recorded fhir:outcome [ # 0..1 Whether the event succeeded or failed fhir:code [ Coding ] ; # 1..1 Whether the event succeeded or failed fhir:detail ( [ CodeableConcept ] ... ) ; # 0..* Additional outcome detail ] ; fhir:authorization ( [ CodeableConcept ] ... ) ; # 0..* Authorization related to the event fhir:basedOn ( [ Reference(CarePlan|DeviceRequest|ImmunizationRecommendation|MedicationRequest| NutritionOrder|ServiceRequest|Task) ] ... ) ; # 0..* Workflow authorization within which this event occurred fhir:patient [ Reference(Patient) ] ; # 0..1 The patient is the subject of the data used/created/updated/deleted during the activity fhir:encounter [ Reference(Encounter) ] ; # 0..1 Encounter within which this event occurred or which the event is tightly associated fhir:agent ( [ # 1..* Actor involved in the event fhir:type [ CodeableConcept ] ; # 0..1 How agent participated fhir:role ( [ CodeableConcept ] ... ) ; # 0..* Agent role in the event fhir:who [ Reference(CareTeam|Device|Organization|Patient|Practitioner|PractitionerRole|RelatedPerson) ] ; # 1..1 Identifier of who fhir:requestor [ boolean ] ; # 0..1 Whether user is initiator fhir:location [ Reference(Location) ] ; # 0..1 The agent location when the event occurred fhir:policy ( [ uri ] ... ) ; # 0..* Policy that authorized the agent participation in the event # network[x] : 0..1 This agent network location for the activity. One of these 3 fhir:network [ a fhir:Reference ; Reference(Endpoint) ] fhir:network [ a fhir:uri ; uri ] fhir:network [ a fhir:string ; string ] fhir:authorization ( [ CodeableConcept ] ... ) ; # 0..* Allowable authorization for this agent ] ... ) ; fhir:source [ # 1..1 Audit Event Reporter fhir:site [ Reference(Location) ] ; # 0..1 Logical source location within the enterprise fhir:observer [ Reference(CareTeam|Device|Organization|Patient|Practitioner|PractitionerRole|RelatedPerson) ] ; # 1..1 The identity of source detecting the event fhir:type ( [ CodeableConcept ] ... ) ; # 0..* The type of source where event originated ] ; fhir:entity ( [ # 0..* Data or objects used fhir:what [ Reference(Any) ] ; # 0..1 Specific instance of resource fhir:role [ CodeableConcept ] ; # 0..1 What role the entity played fhir:securityLabel ( [ CodeableConcept ] ... ) ; # 0..* Security labels on the entity fhir:query [ base64Binary ] ; # 0..1 Query parameters fhir:detail ( [ # 0..* Additional Information about the entity fhir:type [ CodeableConcept ] ; # 1..1 Name of the property # value[x] : 1..1 Property value. One of these 11 fhir:value [ a fhir:Quantity ; Quantity ] fhir:value [ a fhir:CodeableConcept ; CodeableConcept ] fhir:value [ a fhir:string ; string ] fhir:value [ a fhir:boolean ; boolean ] fhir:value [ a fhir:integer ; integer ] fhir:value [ a fhir:Range ; Range ] fhir:value [ a fhir:Ratio ; Ratio ] fhir:value [ a fhir:time ; time ] fhir:value [ a fhir:dateTime ; dateTime ] fhir:value [ a fhir:Period ; Period ] fhir:value [ a fhir:base64Binary ; base64Binary ] ] ... ) ; fhir:agent ( [ See AuditEvent.agent ] ... ) ; # 0..* Entity is attributed to this agent ] ... ) ; ]
Changes
since
R3
from
both
R4
and
R4B
| AuditEvent | |
| AuditEvent.category |
|
|
|
|
|
|
|
| AuditEvent.occurred[x] |
|
| AuditEvent.outcome |
|
|
|
|
|
|
|
| AuditEvent.authorization |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| AuditEvent.agent.authorization |
|
| AuditEvent.source.site |
|
| AuditEvent.source.observer |
|
| AuditEvent.source.type |
|
| AuditEvent.entity.role |
|
| AuditEvent.entity.securityLabel |
|
| AuditEvent.entity.detail.type |
|
| AuditEvent.entity.detail.value[x] |
|
| AuditEvent.entity.agent |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| AuditEvent.agent.network.address |
|
| AuditEvent.agent.network.type |
|
| AuditEvent.entity.type |
|
| AuditEvent.entity.lifecycle |
|
| AuditEvent.entity.name |
|
| AuditEvent.entity.description |
|
See the Full Difference for further information
This analysis is available for R4 as XML or JSON and for R4B as XML or JSON .
See
R3
<-->
R4
<-->
R5
Conversion
Maps
(status
=
8
tests
that
all
execute
ok.
All
tests
pass
round-trip
testing
and
all
r3
resources
are
valid.)
See
Conversions
Summary
.)
Structure
| Name | Flags | Card. | Type |
Description
&
Constraints
|
|---|---|---|---|---|
|
AuditEvent
|
TU | DomainResource |
Elements defined in Ancestors: id , meta , implicitRules , language , text , contained , extension , modifierExtension |
|
|
|
Σ |
|
|
Type/identifier
of
event
Binding: Audit Event ID ( |
|
|
Σ |
|
|
Binding: Audit Event Sub-Type ( |
|
action
|
Σ | 0..1 | code |
Type
of
action
performed
during
the
event
Binding: |
|
severity
|
Σ | 0..1 |
|
emergency
|
alert
|
critical
|
error
|
warning
|
notice
|
informational
|
debug
Binding: Audit Event Severity ( Required ) |
|
occurred[x]
| 0..1 |
When
the
activity
occurred
|
||
|
occurredPeriod
|
|
|||
|
occurredDateTime
|
|
|
||
|
|
Σ |
|
|
|
|
outcome
|
Σ | 0..1 |
|
|
|
|
Σ |
|
|
|
|
detail
|
Σ |
|
|
Binding: Audit Event Outcome Detail ( Example ) |
|
|
Σ |
|
CodeableConcept |
Binding: PurposeOfUse
|
|
basedOn
|
0..* |
|
|
|
|
|
|
0..1 |
Reference
(
|
|
|
encounter
|
0..1 |
|
|
|
|
agent
|
Σ |
|
|
|
|
type
|
|
|
Binding: Participation Role Type ( Preferred ) |
|
|
role
|
0..* |
|
Binding: Security Role Type ( |
|
|
who
|
Σ |
|
|
|
|
requestor
|
Σ | 0..1 |
|
|
|
location
|
0..1 |
|
|
|
|
|
|
|
|
|
|
network[x]
|
0..1 |
|
|
|
|
networkReference
|
Reference
(
|
|||
|
networkUri
| uri | |||
|
networkString
| string | |||
|
authorization
| 0..* | CodeableConcept |
Allowable
authorization
for
this
Binding: PurposeOfUse
|
|
|
source
|
Σ | 1..1 | BackboneElement |
Audit
Event
Reporter
|
|
site
|
0..1 |
|
Logical
source
location
within
the
enterprise
|
|
|
observer
|
Σ | 1..1 |
Reference
(
|
The
identity
of
source
detecting
the
event
|
|
type
|
0..* |
|
The
type
of
source
where
event
originated
Binding: Audit Event Source Type ( |
|
|
entity
|
|
0..* | BackboneElement |
Data
or
objects
used
|
|
what
|
Σ | 0..1 | Reference ( Any ) |
Specific
instance
of
resource
|
|
role
|
0..1 | CodeableConcept |
What
role
the
entity
played
Binding: Audit Event Entity Role ( Example ) | |
|
securityLabel
|
|
|
|
|
|
query
|
Σ | 0..1 |
|
|
|
detail
|
|
|
|
|
|
|
|
|
|
|
|
value[x]
|
1..1 |
|
||
|
valueQuantity
|
Quantity | |||
|
valueCodeableConcept
|
CodeableConcept | |||
|
valueString
|
|
string | ||
|
|
|
|||
|
valueInteger
|
|
|||
|
valueRange
| Range | |||
|
valueRatio
|
|
|
||
|
|
|
|
||
|
valueDateTime
|
|
|||
|
valuePeriod
|
|
|||
|
valueBase64Binary
|
base64Binary | |||
|
agent
| 0..* | see agent |
Entity
is
attributed
to
this
agent
|
|
|
Documentation
for
this
format
|
||||
See the Extensions for this resource
XML Template
<<AuditEvent xmlns="http://hl7.org/fhir"><</type> <</subtype><category><!-- 0..* CodeableConcept Type/identifier of event --></category> <code><!-- 1..1 CodeableConcept Specific type of event --></code> <action value="[code]"/><!-- 0..1 Type of action performed during the event --><</period><severity value="[code]"/><!-- 0..1 emergency | alert | critical | error | warning | notice | informational | debug --> <occurred[x]><!-- 0..1 Period|dateTime When the activity occurred --></occurred[x]> <recorded value="[instant]"/><!-- 1..1 Time when the event was recorded -->< < <</purposeOfEvent><outcome> <!-- 0..1 Whether the event succeeded or failed --> <code><!-- 1..1 Coding Whether the event succeeded or failed --></code> <detail><!-- 0..* CodeableConcept Additional outcome detail --></detail> </outcome> <authorization><!-- 0..* CodeableConcept Authorization related to the event<</type> <</role> <| </who> < < < <</location> < <</media> < < < </network> <</purposeOfUse><type><!-- 0..1 CodeableConcept How agent participated --></type> <role><!-- 0..* CodeableConcept Agent role in the event --></role> <who><!-- 1..1 Reference(CareTeam|Device|Organization|Patient|Practitioner| PractitionerRole|RelatedPerson) Identifier of who --></who> <requestor value="[boolean]"/><!-- 0..1 Whether user is initiator --> <location><!-- 0..1 Reference(Location) The agent location when the event occurred --></location> <policy value="[uri]"/><!-- 0..* Policy that authorized the agent participation in the event --> <network[x]><!-- 0..1 Reference(Endpoint)|uri|string This agent network location for the activity --></network[x]> <authorization><!-- 0..* CodeableConcept Allowable authorization for this agent< < <| </observer> <</type><source> <!-- 1..1 Audit Event Reporter --> <site><!-- 0..1 Reference(Location) Logical source location within the enterprise --></site> <observer><!-- 1..1 Reference(CareTeam|Device|Organization|Patient|Practitioner| PractitionerRole|RelatedPerson) The identity of source detecting the event --></observer> <type><!-- 0..* CodeableConcept The type of source where event originated --></type> </source> <entity> <!-- 0..* Data or objects used --><</what> <</type> <</role> <</lifecycle> <</securityLabel> < < <<what><!-- 0..1 Reference(Any) Specific instance of resource --></what> <role><!-- 0..1 CodeableConcept What role the entity played --></role> <securityLabel><!-- 0..* CodeableConcept Security labels on the entity --></securityLabel> <query value="[base64Binary]"/><!-- 0..1 Query parameters --> <detail> <!-- 0..* Additional Information about the entity -->< <</value[x]><type><!-- 1..1 CodeableConcept Name of the property --></type> <value[x]><!-- 1..1 Quantity|CodeableConcept|string|boolean|integer|Range| Ratio|time|dateTime|Period|base64Binary Property value --></value[x]> </detail> <agent><!-- 0..* Content as for AuditEvent.agent Entity is attributed to this agent --></agent> </entity> </AuditEvent>
JSON Template
{
"resourceType" : "",
"resourceType" : "AuditEvent",
// from Resource: id, meta, implicitRules, and language
// from DomainResource: text, contained, extension, and modifierExtension
"
"
"category" : [{ CodeableConcept }], // Type/identifier of event
"code" : { CodeableConcept }, // R! Specific type of event
"action" : "<code>", // Type of action performed during the event
"
"severity" : "<code>", // emergency | alert | critical | error | warning | notice | informational | debug
// occurred[x]: When the activity occurred. One of these 2:
"occurredPeriod" : { Period },
"occurredDateTime" : "<dateTime>",
"recorded" : "<instant>", // R! Time when the event was recorded
"
"
"
"outcome" : { // Whether the event succeeded or failed
"code" : { Coding }, // R! Whether the event succeeded or failed
"detail" : [{ CodeableConcept }] // Additional outcome detail
},
"authorization" : [{ CodeableConcept }], // Authorization related to the event
"basedOn" : [{ Reference(CarePlan|DeviceRequest|ImmunizationRecommendation|
MedicationRequest|NutritionOrder|ServiceRequest|Task) }], // Workflow authorization within which this event occurred
"patient" : { Reference(Patient) }, // The patient is the subject of the data used/created/updated/deleted during the activity
"encounter" : { Reference(Encounter) }, // Encounter within which this event occurred or which the event is tightly associated
"agent" : [{ // R! Actor involved in the event
"
"
"|
"
"
"
"
"
"
"
"
"
},
"
"type" : { CodeableConcept }, // How agent participated
"role" : [{ CodeableConcept }], // Agent role in the event
"who" : { Reference(CareTeam|Device|Organization|Patient|Practitioner|
PractitionerRole|RelatedPerson) }, // R! Identifier of who
"requestor" : <boolean>, // Whether user is initiator
"location" : { Reference(Location) }, // The agent location when the event occurred
"policy" : ["<uri>"], // Policy that authorized the agent participation in the event
// network[x]: This agent network location for the activity. One of these 3:
"networkReference" : { Reference(Endpoint) },
"networkUri" : "<uri>",
"networkString" : "<string>",
"authorization" : [{ CodeableConcept }] // Allowable authorization for this agent
}],
"
"
"|
"
"source" : { // R! Audit Event Reporter
"site" : { Reference(Location) }, // Logical source location within the enterprise
"observer" : { Reference(CareTeam|Device|Organization|Patient|Practitioner|
PractitionerRole|RelatedPerson) }, // R! The identity of source detecting the event
"type" : [{ CodeableConcept }] // The type of source where event originated
},
"entity" : [{ // Data or objects used
"
"
"
"
"
"
"
"
"what" : { Reference(Any) }, // Specific instance of resource
"role" : { CodeableConcept }, // What role the entity played
"securityLabel" : [{ CodeableConcept }], // Security labels on the entity
"query" : "<base64Binary>", // Query parameters
"detail" : [{ // Additional Information about the entity
"
">"
"type" : { CodeableConcept }, // R! Name of the property
// value[x]: Property value. One of these 11:
"valueQuantity" : { Quantity },
"valueCodeableConcept" : { CodeableConcept },
"valueString" : "<string>",
"valueBoolean" : <boolean>,
"valueInteger" : <integer>,
"valueRange" : { Range },
"valueRatio" : { Ratio },
"valueTime" : "<time>",
"valueDateTime" : "<dateTime>",
"valuePeriod" : { Period },
"valueBase64Binary" : "<base64Binary>"
}]
}],
"agent" : [{ Content as for AuditEvent.agent }] // Entity is attributed to this agent
}]
}
Turtle Template
@prefix fhir: <http://hl7.org/fhir/> .[ a fhir:;[ a fhir:AuditEvent; fhir:nodeRole fhir:treeRoot; # if this is the parser root # from Resource: .id, .meta, .implicitRules, and .language # from DomainResource: .text, .contained, .extension, and .modifierExtensionfhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: ]; fhir: ], ...; fhir: fhir: fhir: fhir: ]; fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: fhir: # . One of these 2 fhir: ] fhir: ] ], ...; ], ...;fhir:category ( [ CodeableConcept ] ... ) ; # 0..* Type/identifier of event fhir:code [ CodeableConcept ] ; # 1..1 Specific type of event fhir:action [ code ] ; # 0..1 Type of action performed during the event fhir:severity [ code ] ; # 0..1 emergency | alert | critical | error | warning | notice | informational | debug # occurred[x] : 0..1 When the activity occurred. One of these 2 fhir:occurred [ a fhir:Period ; Period ] fhir:occurred [ a fhir:dateTime ; dateTime ] fhir:recorded [ instant ] ; # 1..1 Time when the event was recorded fhir:outcome [ # 0..1 Whether the event succeeded or failed fhir:code [ Coding ] ; # 1..1 Whether the event succeeded or failed fhir:detail ( [ CodeableConcept ] ... ) ; # 0..* Additional outcome detail ] ; fhir:authorization ( [ CodeableConcept ] ... ) ; # 0..* Authorization related to the event fhir:basedOn ( [ Reference(CarePlan|DeviceRequest|ImmunizationRecommendation|MedicationRequest| NutritionOrder|ServiceRequest|Task) ] ... ) ; # 0..* Workflow authorization within which this event occurred fhir:patient [ Reference(Patient) ] ; # 0..1 The patient is the subject of the data used/created/updated/deleted during the activity fhir:encounter [ Reference(Encounter) ] ; # 0..1 Encounter within which this event occurred or which the event is tightly associated fhir:agent ( [ # 1..* Actor involved in the event fhir:type [ CodeableConcept ] ; # 0..1 How agent participated fhir:role ( [ CodeableConcept ] ... ) ; # 0..* Agent role in the event fhir:who [ Reference(CareTeam|Device|Organization|Patient|Practitioner|PractitionerRole|RelatedPerson) ] ; # 1..1 Identifier of who fhir:requestor [ boolean ] ; # 0..1 Whether user is initiator fhir:location [ Reference(Location) ] ; # 0..1 The agent location when the event occurred fhir:policy ( [ uri ] ... ) ; # 0..* Policy that authorized the agent participation in the event # network[x] : 0..1 This agent network location for the activity. One of these 3 fhir:network [ a fhir:Reference ; Reference(Endpoint) ] fhir:network [ a fhir:uri ; uri ] fhir:network [ a fhir:string ; string ] fhir:authorization ( [ CodeableConcept ] ... ) ; # 0..* Allowable authorization for this agent ] ... ) ; fhir:source [ # 1..1 Audit Event Reporter fhir:site [ Reference(Location) ] ; # 0..1 Logical source location within the enterprise fhir:observer [ Reference(CareTeam|Device|Organization|Patient|Practitioner|PractitionerRole|RelatedPerson) ] ; # 1..1 The identity of source detecting the event fhir:type ( [ CodeableConcept ] ... ) ; # 0..* The type of source where event originated ] ; fhir:entity ( [ # 0..* Data or objects used fhir:what [ Reference(Any) ] ; # 0..1 Specific instance of resource fhir:role [ CodeableConcept ] ; # 0..1 What role the entity played fhir:securityLabel ( [ CodeableConcept ] ... ) ; # 0..* Security labels on the entity fhir:query [ base64Binary ] ; # 0..1 Query parameters fhir:detail ( [ # 0..* Additional Information about the entity fhir:type [ CodeableConcept ] ; # 1..1 Name of the property # value[x] : 1..1 Property value. One of these 11 fhir:value [ a fhir:Quantity ; Quantity ] fhir:value [ a fhir:CodeableConcept ; CodeableConcept ] fhir:value [ a fhir:string ; string ] fhir:value [ a fhir:boolean ; boolean ] fhir:value [ a fhir:integer ; integer ] fhir:value [ a fhir:Range ; Range ] fhir:value [ a fhir:Ratio ; Ratio ] fhir:value [ a fhir:time ; time ] fhir:value [ a fhir:dateTime ; dateTime ] fhir:value [ a fhir:Period ; Period ] fhir:value [ a fhir:base64Binary ; base64Binary ] ] ... ) ; fhir:agent ( [ See AuditEvent.agent ] ... ) ; # 0..* Entity is attributed to this agent ] ... ) ; ]
Changes
since
Release
3
from
both
R4
and
R4B
| AuditEvent | |
| AuditEvent.category |
|
|
|
|
|
|
|
| AuditEvent.occurred[x] |
|
| AuditEvent.outcome |
|
|
|
|
|
|
|
| AuditEvent.authorization |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| AuditEvent.agent.authorization |
|
| AuditEvent.source.site |
|
| AuditEvent.source.observer |
|
| AuditEvent.source.type |
|
| AuditEvent.entity.role |
|
| AuditEvent.entity.securityLabel |
|
| AuditEvent.entity.detail.type |
|
| AuditEvent.entity.detail.value[x] |
|
| AuditEvent.entity.agent |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| AuditEvent.agent.network.address |
|
| AuditEvent.agent.network.type |
|
| AuditEvent.entity.type |
|
| AuditEvent.entity.lifecycle |
|
| AuditEvent.entity.name |
|
| AuditEvent.entity.description |
|
See the Full Difference for further information
This analysis is available for R4 as XML or JSON and for R4B as XML or JSON .
See
R3
<-->
R4
<-->
R5
Conversion
Maps
(status
=
8
tests
that
all
execute
ok.
All
tests
pass
round-trip
testing
and
all
r3
resources
are
valid.)
See
Conversions
Summary
.)
See
the
Profiles
&
Extensions
and
the
alternate
Additional
definitions:
Master
Definition
XML
+
JSON
,
XML
Schema
/
Schematron
+
JSON
Schema
,
ShEx
(for
Turtle
)
+
see
the
extensions
,
the
spreadsheet
version
&
the
dependency
analysis
| Path |
|
Type |
|
|---|---|---|---|
|
|
|
|
Event Categories for Audit Events - defined by DICOM with some FHIR specific additions. |
|
|
|
|
More detailed code concerning the type of the audit event - defined by DICOM with some additional FHIR, HL7, and other additions. |
| AuditEvent.action | AuditEventAction | Required | Indicator for type of action performed during the event that generated the event. |
| AuditEvent.severity | AuditEventSeverity | Required |
The severity of the audit entry. |
| AuditEvent.outcome.code |
|
|
Indicates whether the event succeeded or failed. |
| AuditEvent.outcome.detail |
)
|
|
Indicates more detailed reason for outcome. |
| AuditEvent.authorization |
|
|
Supports communication of purpose of use at a general level. |
| AuditEvent.agent.type |
|
|
This FHIR value set is comprised of Actor participation Type codes, which can be used to value FHIR agents, actors, and other role elements. The codes are intended to express how the agent participated in some activity. Sometimes refered to the agent functional-role relative to the activity. |
| AuditEvent.agent.role |
|
|
This value set contains example structural roles. In general, two types of roles can be distinguished: structural roles and functional roles. Structural Roles reflect human or organizational categories (hierarchies), and describe prerequisites, feasibilities, or competences for actions. Functional roles are bound to the realization or performance of actions. |
| AuditEvent.agent.authorization |
|
|
Supports communication of purpose of use at a general level. |
| AuditEvent.source.type |
|
|
The type of process where the audit event originated from. Use of these codes is not required but is encouraged to maintain translation with DICOM AuditMessage schema. |
| AuditEvent.entity.role |
|
|
Code
representing
the
role
the
entity
played
in
the
audit
event.
|
| AuditEvent.entity.securityLabel |
|
|
A
sample
of
security
labels
from
|
| AuditEvent.entity.detail.type |
|
|
Event Categories for Audit Events - defined by DICOM with some FHIR specific additions. |
The AuditEvent resource and the ATNA Audit record are used in many contexts throughout healthcare. The coded values defined in the "extensible" bindings above are those widely used and/or defined by DICOM, IHE or ISO, who defined these codes to meet very specific use cases. These codes should be used when they are suitable. When needed, other codes can be defined.
Note:
When
using
codes
from
a
vocabulary,
the
display
element
for
the
code
can
be
left
off
to
keep
the
AuditEvent
size
small
and
minimize
impact
of
a
large
audit
log
of
similar
entries.
The set of codes defined for this resource is expected to grow over time, and additional codes may be proposed / requested using the "Propose a change" link above below.
This table summarizes common event scenarios, and the codes that should be used for each case.
| Scenario |
|
|
action | Other |
| User Login ( example ) |
110114
User
Authentication
|
110122
User
Authentication
|
E Execute | One agent which contains the details of the logged-in user. |
| User Logout ( example ) |
110114
User
Authentication
|
110123
User
Logout
|
E Execute | One agent which contains the details of the logged-out user. |
| REST operation logged on server ( example ) | rest RESTful Operation | [code] defined for operation | * (see below) | Agent for logged in user, if available. |
| Search operation logged on server ( example ) | rest RESTful Operation | [code] defined for operation | E Execute | Agent for logged in user, if available, and one object with a query element. The Execute action is used as the server must execute the search parameters to get the results, whereas a Read action identifies a specific object. |
| Break-Glass started ( example ) |
110113
Security
Alert
|
110127
Emergency
Override
Started
| E Execute | Agent is the user who is authorized to break-glass and has declared an emergency override. Note there is an Emergency Override Stopped code that can be used to indicate the closing of the break-glass event, when it is known. |
Audit Event Actions for RESTful operations:
| Operation | Action |
| create | C |
| read, vread, history-instance, history-type, history-system | R |
| update | U |
| delete | D |
| transaction, operation, conformance, validate, search, search-type, search-system | E |
A
search
event
is
recorded
as
an
Execute
action
as
the
server
must
execute
the
search
parameters
to
get
the
results.
The
category
is
a
rest
operation.
The
code
should
be
search
.
The
Server
is
identified
in
an
.agent
as
the
role
Destination
Role
ID
,
and
the
client
is
identified
in
an
.agent
as
the
role
Source
Role
ID
.
Additional
.agent
elements
may
be
used
to
identify
user,
application,
organization,
etc.
A
Search
Event
records
one
.entity
element
that
holds
the
search
request,
and
should
not
record
the
contents
of
the
search
response
so
as
to
limit
duplication
of
sensitive
health
information
that
is
already
present
in
the
system,
and
discoverable
by
replaying
the
search
request.
The
AuditEvent.entity.query
shall
hold
the
whole
WHOLE
http
header
and
body
encoded
as
base64binary.
This
should
preserve
as
much
of
the
raw
http
header
and
body
as
possible
to
best
capture
any
attempts
by
clients
or
intermediaries
to
misbehave.
There
should
be
no
sanitization
or
normalization
of
this
value.
The
FHIR
specification
defines
a
harmonized
search
parameter
string,
which
is
returned
in
the
searchset
bundle
as
the
.link.url
on
the
.link
for
self.
This
string
could
be
recorded
in
the
AuditEvent.entry.description
as
it
is
well
behaved
and
represents
what
was
actually
processed
as
search
parameters.
See:
conformance
Where there are identifiable Patient subject(s) associated with the returned Resource(s), the AuditEvent.patient should be used to record the Patient as the subject of the data or activity. When multiple patient results are returned one AuditEvent is created for every Patient identified in the resulting search set. Note this is true when the search set bundle includes any number of resources that collectively reference multiple Patients. This includes one Resource with multiple subject values, or many Resources with single subject values that are different.
FHIR interactions can result in a rich description of the outcome using the OperationOutcome . The OperationOutcome Resource is a collection of error, warning or information messages that result from a system action. This describes in detail the outcome of some operation, such as when a RESTful operation fails.
When recording into an AuditEvent that some FHIR interaction has happened, the AuditEvent should include the OperationOutcome from that FHIR interaction. This is done by placing the OperationOutcome into an AuditEvent.entity. Likely as a contained resource, given that OperationOutcome resources often are not persisted.
is
the
OperationOutcome
--
Likely
contained
entity.who
entity.what
entity.type
is
code
OperationOutcome
entity.description
explains
why
this
OperationOutcome
was
included.
See
transaction
failure
example
:
When
a
client
attempts
to
post
(create)
an
Observation
Resource,
using
a
server
Patient
endpoint;
this
would
result
in
an
error
with
an
OperationOutcome.
The
AuditEvent
provides
the
element
to
convey
the
purpose
of
use
for
the
whole
event
and
purposeOfEvent
AudientEvent.authorization
to
convey
the
purposeOfUse
AuditEvent.agent.authorization
reason
purpose
of
use
that
a
particular
actor
(machine,
person,
software)
was
involved
in
the
event.
is
an
element
at
the
level
of
AuditEvent
and
can
convey
the
purpose
of
the
activity
that
resulted
in
the
event.
This
will
occur
when
the
system
that
is
reporting
the
event
is
aware
of
the
purpose
of
the
event.
A
specific
example
would
be
a
radiology
reporting
system
where
a
radiologist
has
created
and
is
sending
a
finished
report.
This
system
likely
knows
the
purpose,
e.g.,
"treatment".
It
is
multi-valued
because
the
one
event
may
be
related
to
multiple
purposes.
purposeOfEvent
AuditEvent.authorization
It
is
also
commonplace
that
the
reporting
system
does
not
have
information
about
the
purpose
of
the
event.
In
these
cases,
the
event
report
would
not
have
a
purposeOfEvent.
an
authorization.
It
is
also
likely
that
the
same
event
will
be
reported
from
different
perspectives,
e.g.,
by
both
the
sender
and
recipient
of
a
communication.
These
two
different
perspectives
can
have
different
knowledge
regarding
the
purposeOfEvent
.
purposeOfUse
authorization.
is
an
element
at
the
level
of
purposeOfUse
AuditEvent.agent.authorization
agent
within
AuditEvent.
This
describes
the
reason
that
this
person,
machine,
or
software
is
participating
in
the
activity
that
resulted
in
the
event.
For
example,
an
individual
person
participating
in
the
event
may
assert
a
purpose
of
use
from
their
perspective.
It
is
also
possible
that
they
are
participating
for
multiple
reasons
and
report
multiple
purposeOfUse.
The reporting system might not have knowledge regarding why a particular machine or person was involved and would omit this element in those cases.
When the same event is reported from multiple perspectives, the reports can have different knowledge regarding the purpose.
It is a best practice to include a reference to the Patient affected by any auditable event, in order to enable Privacy Accounting of Disclosures and Access Logs, and to enable privacy office and security office audit log analysis. Reasonable efforts should be taken to assure the Patient is recorded, but it is recognized that there are times when this is not reasonable.
Where an activity impacts more than one Patient subject; multiple AuditEvent resources should be recorded, one for each Patient subject. This best enables segmentation of the AuditEvent details so as to limit the Privacy impact. The use of multiple AuditEvent is a best-practice and should be driven by a Policy. There will be cases where the use of multiple AuditEvent resources are not necessary, such as public health reporting.
To record a REST interaction or $operation, it is often necessary to complete the transaction in order to determine the Patient subject. Inspection of the potential returned results may be necessary. Some REST and $operations include parameters limiting the results to a specific Patient, in these cases this parameter informs the inclusion of the Patient reference.
Implementation Guides may make the AuditEvent requirements more clear given the workflow or security context mandated by the Implementation Guide.
Search parameters for this resource. See also the full list of search parameters for this resource , and check the Extensions registry for search parameters on extensions related to this resource. The common parameters also apply. See Searching for more information about searching in REST, messaging, and services.
| Name | Type | Description | Expression | In Common |
| action | token | Type of action performed during the event | AuditEvent.action | |
|
|
|
Identifier of who |
AuditEvent.agent.who
( Practitioner , Organization , CareTeam , Device , Patient , PractitionerRole , RelatedPerson ) |
|
|
|
|
|
|
|
|
|
|
|
( CarePlan , MedicationRequest , Task , NutritionOrder , DeviceRequest , ServiceRequest , ImmunizationRecommendation ) |
|
|
|
token |
|
|
|
|
|
|
|
|
22 Resources |
|
|
|
|
|
27 Resources |
|
|
|
|
( Encounter ) |
29 Resources |
|
|
|
|
(Any) |
|
|
|
token |
|
|
|
| outcome | token | Whether the event succeeded or failed |
|
|
| patient | reference |
|
( Patient ) |
66 Resources |
| policy | uri | Policy that authorized event | AuditEvent.agent.policy | |
|
|
token |
|
|
|
| source | reference | The identity of source detecting the event |
AuditEvent.source.observer
( Practitioner , Organization , CareTeam , Device , Patient , PractitionerRole , RelatedPerson ) |
FHIR
®©
HL7.org
2011+.
FHIR
Release
4
(Technical
Correction
#1)
(v4.0.1)
R5
hl7.fhir.core#5.0.0
generated
on
Fri,
Nov
1,
2019
09:34+1100.
QA
Page
Sun,
Mar
26,
2023
15:24+1100.
Links:
Search
|
Version
History
|
Table
of
Contents
|
Credits
Glossary
|
QA
|
Compare
to
R3
R4
|
Compare
to
R4B
|
|
Propose
a
change