This page is part of the IHE Basic Audit Log Patterns (BALP) (v1.1.2: Publication) based on FHIR R4. This is the current published version in its permanent home (it will always be available at this URL). For a full list of available versions, see the Directory of published versions

Basic Audit Log Patterns (BALP)

Official URL: https://profiles.ihe.net/ITI/BALP/ImplementationGuide/ihe.iti.balp				Version: 1.1.2
Active as of 2023-08-04				Computable Name: IHE_ITI_BALP

The Basic Audit Log Patterns (BALP) Implementation Guide is a Content Profile that defines some basic and reusable AuditEvent patterns. This includes basic audit log profiles for FHIR RESTful operations to be used when there is not a more specific audit event defined. A focus is on enabling Privacy centric AuditEvent logs that hold well-formed indication of the Patient when they are the subject of the activity being recorded in the log. Where a more specific audit event can be defined, it should be derived off of these basic patterns.

Organization of This Guide

This guide is organized into four main sections:

• Volume 1: Profiles
  • 52 BasicAudit Introduction
  • 52.1 BasicAudit Actors and Content
  • 52.2 BasicAudit Actor Options
  • 52.3 BasicAudit Required Groupings
  • 52.4 BasicAudit Overview
  • 52.5 BasicAudit Security Considerations
  • 52.6 BasicAudit Cross-Profile Considerations
• Volume 3: Content Section
  • 5.7 Basic Audit Log Patterns
  • 5.7.3 RESTful activities
  • 5.7.4 SAML Security Token
  • 5.7.5 OAuth Security Token
  • 5.7.6 Consent Authorized Decision Audit Message
  • 5.7.7 Privacy Disclosure Audit Message
• Artifacts
• Other:
  • Test Plan
  • Changes to other documents
  • Download and Analysis
  • AuditEvent use in Other Profiles

See also the table of contents and the index of artifacts defined as part of this implementation guide.

Conformance Expectations

IHE uses the normative words Shall, Should, and May according to standards conventions.

Must Support

The use of mustSupport in StructureDefinition profiles equivalent to the IHE use of R2 as defined in Appendix Z.

mustSupport of true - only has a meaning on items that are minimal cardinality of zero (0), and applies only to the source actor populating the data. The source actor shall populate the elements marked with MustSupport, if the concept is supported by the actor, a value exists, and security and consent rules permit. The consuming actors should handle these elements being populated or being absent/empty. Note that sometimes mustSupport will appear on elements with a minimal cardinality greater than zero (0), this is due to inheritance from a less constrained profile.