Basic Audit Log Patterns (BALP)
1.1.3 - Trial-Implementation International flag

This page is part of the IHE Basic Audit Log Patterns (BALP) (v1.1.3: Publication) based on FHIR (HL7® FHIR® Standard) R4. This is the current published version. For a full list of available versions, see the Directory of published versions

Resource Profile: Basic AuditEvent for a successful Query

Official URL: https://profiles.ihe.net/ITI/BALP/StructureDefinition/IHE.BasicAudit.Query Version: 1.1.3
Active as of 2024-02-14 Computable Name: Query

A basic AuditEvent profile for when a RESTful Query / Search action happens successfully.

  • Given a RESTful Query is requested
  • And the request does not have a Patient subject indicated
    • The requestor logging the event would potentially not know they have requested Patient specific data
    • The data objects may not be patient specific kind of objects
    • when the request is Patient specific then PatientQuery is used
  • And the request is authorized
  • When successful
    • Note a failure AuditEvent may follow this pattern, but would not be a successful outcome and should have an OperationOutcome
    • Note success may result in zero or more results. The number of results and the content of the results are not recorded.
  • And the results are not Patient specific
    • when the results are Patient specific then PatientQuery are used
  • Then the AuditEvent recorded will conform
    • The raw search request is base64 encoded and placed in the .entity[query].query element. The base64 encoding of the raw search request enables preserving exactly what was requested, including possibly malicious patterns. This enables detection of malicious or malformed requests.
    • The cleaned search may be recorded (not base64) in the .entity[query].description. The cleaned search request would have removed parameters that were not understood/supported. The cleaned search request in the .description element enables more efficient processing.

Note: the pattern defined in DICOM and IHE have the client is identified as the Source Role ID, and the server is identified as the Destination Role ID. This represents the query parameters are flowing from the client to the server. This may not be so obvious, as the data actually flows the opposite direction. This pattern is established and thus followed here.

Usage:

Formal Views of Profile Content

Description of Profiles, Differentials, Snapshots and how the different presentations work.

This structure is derived from AuditEvent

NameFlagsCard.TypeDescription & Constraintsdoco
.. AuditEvent 0..*AuditEventEvent record kept for security purposes
... type 1..1CodingType/identifier of event
Required Pattern: At least the following
.... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-event-type
.... code1..1codeSymbol in syntax defined by the system
Fixed Value: rest
... Slices for subtype 1..*CodingMore specific type/id for the event
Slice: Unordered, Open by value:$this
.... subtype:anySearch 1..1CodingMore specific type/id for the event
Binding: all Searches (required)
... action 0..1codeType of action performed during the event
Required Pattern: E
... outcome 1..1codeWhether the event succeeded or failed
Required Pattern: 0
... Slices for agent 2..*BackboneElementActor involved in the event
Slice: Unordered, Open by pattern:type
.... agent:client 1..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110153
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... media 0..0
..... network 1..1BackboneElementLogical network location for application activity
.... agent:server 1..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110152
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... media 0..0
..... network 1..1BackboneElementLogical network location for application activity
.... agent:user 0..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/v3-ParticipationType
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: IRCP
..... role S0..*CodeableConceptAgent role in the event
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... name S0..1stringHuman friendly name for the agent
..... requestor 1..1booleanWhether user is initiator
Required Pattern: true
..... media 0..0
..... network 0..0
..... purposeOfUse S0..*CodeableConceptReason given for this user
... source S1..1BackboneElementAudit Event Reporter
... Slices for entity 1..*BackboneElementData or objects used
Slice: Unordered, Open by pattern:type
.... entity:transaction 0..1BackboneElementData or objects used
..... what
...... identifier
....... value 1..1stringthe value of X-Request-Id
..... type 1..1CodingType of entity involved
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: https://profiles.ihe.net/ITI/BALP/CodeSystem/BasicAuditEntityType
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: XrequestId
.... entity:query 1..1BackboneElementData or objects used
..... what 0..0
..... type 1..1CodingType of entity involved
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-entity-type
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 2
..... role 1..1CodingWhat role the entity played
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/object-role
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 24
..... lifecycle 0..0
..... securityLabel 0..*Codingmay contain the security labels on the Bundle search set returned
..... query 1..1base64BinaryQuery parameters
..... detail 0..0

doco Documentation for this format

Terminology Bindings (Differential)

PathConformanceValueSetURI
AuditEvent.subtype:anySearchrequiredAllSearchVS
https://profiles.ihe.net/ITI/BALP/ValueSet/AllSearchVS
from this IG
NameFlagsCard.TypeDescription & Constraintsdoco
.. AuditEvent 0..*AuditEventEvent record kept for security purposes
... implicitRules ?!Σ0..1uriA set of rules under which this content was created
... modifierExtension ?!0..*ExtensionExtensions that cannot be ignored
... type Σ1..1CodingType/identifier of event
Binding: AuditEventID (extensible): Type of event.


Required Pattern: At least the following
.... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-event-type
.... code1..1codeSymbol in syntax defined by the system
Fixed Value: rest
... Slices for subtype Σ1..*CodingMore specific type/id for the event
Slice: Unordered, Open by value:$this
Binding: AuditEventSub-Type (extensible): Sub-type of event.


.... subtype:anySearch Σ1..1CodingMore specific type/id for the event
Binding: all Searches (required)
... action Σ0..1codeType of action performed during the event
Binding: AuditEventAction (required): Indicator for type of action performed during the event that generated the event.


Required Pattern: E
... recorded Σ1..1instantTime when the event was recorded
... outcome Σ1..1codeWhether the event succeeded or failed
Binding: AuditEventOutcome (required): Indicates whether the event succeeded or failed.


Required Pattern: 0
... Slices for agent 2..*BackboneElementActor involved in the event
Slice: Unordered, Open by pattern:type
.... agent:All Slices Content/Rules for all slices
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... requestor Σ1..1booleanWhether user is initiator
.... agent:client 1..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110153
..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... requestor Σ1..1booleanWhether user is initiator
..... network 1..1BackboneElementLogical network location for application activity
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... agent:server 1..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110152
..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... requestor Σ1..1booleanWhether user is initiator
..... network 1..1BackboneElementLogical network location for application activity
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... agent:user 0..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/v3-ParticipationType
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: IRCP
..... role S0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... name S0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
Required Pattern: true
..... purposeOfUse S0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


... source S1..1BackboneElementAudit Event Reporter
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... observer Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)The identity of source detecting the event
... Slices for entity C1..*BackboneElementData or objects used
Slice: Unordered, Open by pattern:type
.... entity:All Slices Content/Rules for all slices
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... entity:transaction C0..1BackboneElementData or objects used
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodingType of entity involved
Binding: AuditEventEntityType (extensible): Code for the entity type involved in the audit event.


Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: https://profiles.ihe.net/ITI/BALP/CodeSystem/BasicAuditEntityType
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: XrequestId
.... entity:query C1..1BackboneElementData or objects used
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodingType of entity involved
Binding: AuditEventEntityType (extensible): Code for the entity type involved in the audit event.


Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-entity-type
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 2
..... role 1..1CodingWhat role the entity played
Binding: AuditEventEntityRole (extensible): Code representing the role the entity played in the audit event.


Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/object-role
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 24
..... securityLabel 0..*Codingmay contain the security labels on the Bundle search set returned
Binding: All Security Labels (extensible): Security Labels from the Healthcare Privacy and Security Classification System.


..... query ΣC1..1base64BinaryQuery parameters

doco Documentation for this format

Terminology Bindings

PathConformanceValueSet / CodeURI
AuditEvent.typeextensiblePattern: rest
http://hl7.org/fhir/ValueSet/audit-event-type
from the FHIR Standard
AuditEvent.subtypeextensibleAuditEventSub-Type
http://hl7.org/fhir/ValueSet/audit-event-sub-type
from the FHIR Standard
AuditEvent.subtype:anySearchrequiredAllSearchVS
https://profiles.ihe.net/ITI/BALP/ValueSet/AllSearchVS
from this IG
AuditEvent.actionrequiredPattern: E
http://hl7.org/fhir/ValueSet/audit-event-action|4.0.1
from the FHIR Standard
AuditEvent.outcomerequiredPattern: 0
http://hl7.org/fhir/ValueSet/audit-event-outcome|4.0.1
from the FHIR Standard
AuditEvent.agent:client.typeextensiblePattern: 110153
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:server.typeextensiblePattern: 110152
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:user.typeextensiblePattern: IRCP
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:user.roleexampleSecurityRoleType
http://hl7.org/fhir/ValueSet/security-role-type
from the FHIR Standard
AuditEvent.agent:user.purposeOfUseextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.entity:transaction.typeextensiblePattern: XrequestId
http://hl7.org/fhir/ValueSet/audit-entity-type
from the FHIR Standard
AuditEvent.entity:query.typeextensiblePattern: 2
http://hl7.org/fhir/ValueSet/audit-entity-type
from the FHIR Standard
AuditEvent.entity:query.roleextensiblePattern: 24
http://hl7.org/fhir/ValueSet/object-role
from the FHIR Standard
AuditEvent.entity:query.securityLabelextensibleAll Security Labels
http://hl7.org/fhir/ValueSet/security-labels
from the FHIR Standard
NameFlagsCard.TypeDescription & Constraintsdoco
.. AuditEvent 0..*AuditEventEvent record kept for security purposes
... id Σ0..1idLogical id of this artifact
... meta Σ0..1MetaMetadata about the resource
... implicitRules ?!Σ0..1uriA set of rules under which this content was created
... language 0..1codeLanguage of the resource content
Binding: CommonLanguages (preferred): A human language.

Additional BindingsPurpose
AllLanguagesMax Binding
... text 0..1NarrativeText summary of the resource, for human interpretation
... contained 0..*ResourceContained, inline Resources
... extension 0..*ExtensionAdditional content defined by implementations
... modifierExtension ?!0..*ExtensionExtensions that cannot be ignored
... type Σ1..1CodingType/identifier of event
Binding: AuditEventID (extensible): Type of event.


Required Pattern: At least the following
.... id0..1stringUnique id for inter-element referencing
.... extension0..*ExtensionAdditional content defined by implementations
.... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-event-type
.... version0..1stringVersion of the system - if relevant
.... code1..1codeSymbol in syntax defined by the system
Fixed Value: rest
.... display0..1stringRepresentation defined by the system
.... userSelected0..1booleanIf this coding was chosen directly by the user
... Slices for subtype Σ1..*CodingMore specific type/id for the event
Slice: Unordered, Open by value:$this
Binding: AuditEventSub-Type (extensible): Sub-type of event.


.... subtype:anySearch Σ1..1CodingMore specific type/id for the event
Binding: all Searches (required)
... action Σ0..1codeType of action performed during the event
Binding: AuditEventAction (required): Indicator for type of action performed during the event that generated the event.


Required Pattern: E
... period 0..1PeriodWhen the activity occurred
... recorded Σ1..1instantTime when the event was recorded
... outcome Σ1..1codeWhether the event succeeded or failed
Binding: AuditEventOutcome (required): Indicates whether the event succeeded or failed.


Required Pattern: 0
... outcomeDesc Σ0..1stringDescription of the event outcome
... purposeOfEvent Σ0..*CodeableConceptThe purposeOfUse of the event
Binding: PurposeOfUse (extensible): The reason the activity took place.


... Slices for agent 2..*BackboneElementActor involved in the event
Slice: Unordered, Open by pattern:type
.... agent:All Slices Content/Rules for all slices
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 0..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.

..... role 0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ0..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... altId 0..1stringAlternative User identity
..... name 0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
..... location 0..1Reference(Location)Where
..... policy 0..*uriPolicy that authorized event
..... media 0..1CodingType of media
Binding: MediaTypeCode (extensible): Used when the event is about exporting/importing onto media.

..... network 0..1BackboneElementLogical network location for application activity
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
...... address 0..1stringIdentifier for the network access point of the user device
...... type 0..1codeThe type of network access point
Binding: AuditEventAgentNetworkType (required): The type of network access point of this agent in the audit event.

..... purposeOfUse 0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


.... agent:client 1..1BackboneElementActor involved in the event
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... id0..1stringUnique id for inter-element referencing
....... extension0..*ExtensionAdditional content defined by implementations
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... version0..1stringVersion of the system - if relevant
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110153
....... display0..1stringRepresentation defined by the system
....... userSelected0..1booleanIf this coding was chosen directly by the user
...... text0..1stringPlain text representation of the concept
..... role 0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... altId 0..1stringAlternative User identity
..... name 0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
..... location 0..1Reference(Location)Where
..... policy 0..*uriPolicy that authorized event
..... network 1..1BackboneElementLogical network location for application activity
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
...... address 0..1stringIdentifier for the network access point of the user device
...... type 0..1codeThe type of network access point
Binding: AuditEventAgentNetworkType (required): The type of network access point of this agent in the audit event.

..... purposeOfUse 0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


.... agent:server 1..1BackboneElementActor involved in the event
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... id0..1stringUnique id for inter-element referencing
....... extension0..*ExtensionAdditional content defined by implementations
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... version0..1stringVersion of the system - if relevant
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110152
....... display0..1stringRepresentation defined by the system
....... userSelected0..1booleanIf this coding was chosen directly by the user
...... text0..1stringPlain text representation of the concept
..... role 0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... altId 0..1stringAlternative User identity
..... name 0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
..... location 0..1Reference(Location)Where
..... policy 0..*uriPolicy that authorized event
..... network 1..1BackboneElementLogical network location for application activity
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
...... address 0..1stringIdentifier for the network access point of the user device
...... type 0..1codeThe type of network access point
Binding: AuditEventAgentNetworkType (required): The type of network access point of this agent in the audit event.

..... purposeOfUse 0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


.... agent:user 0..1BackboneElementActor involved in the event
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... id0..1stringUnique id for inter-element referencing
....... extension0..*ExtensionAdditional content defined by implementations
....... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/v3-ParticipationType
....... version0..1stringVersion of the system - if relevant
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: IRCP
....... display0..1stringRepresentation defined by the system
....... userSelected0..1booleanIf this coding was chosen directly by the user
...... text0..1stringPlain text representation of the concept
..... role S0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... altId 0..1stringAlternative User identity
..... name S0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
Required Pattern: true
..... location 0..1Reference(Location)Where
..... policy 0..*uriPolicy that authorized event
..... purposeOfUse S0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


... source S1..1BackboneElementAudit Event Reporter
.... id 0..1stringUnique id for inter-element referencing
.... extension 0..*ExtensionAdditional content defined by implementations
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... site 0..1stringLogical source location within the enterprise
.... observer Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)The identity of source detecting the event
.... type 0..*CodingThe type of source where event originated
Binding: AuditEventSourceType (extensible): Code specifying the type of system that detected and recorded the event.


... Slices for entity C1..*BackboneElementData or objects used
Slice: Unordered, Open by pattern:type
.... entity:All Slices Content/Rules for all slices
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... what Σ0..1Reference(Resource)Specific instance of resource
..... type 0..1CodingType of entity involved
Binding: AuditEventEntityType (extensible): Code for the entity type involved in the audit event.

..... role 0..1CodingWhat role the entity played
Binding: AuditEventEntityRole (extensible): Code representing the role the entity played in the audit event.

..... lifecycle 0..1CodingLife-cycle stage for the entity
Binding: ObjectLifecycleEvents (extensible): Identifier for the data life-cycle stage for the entity.

..... securityLabel 0..*CodingSecurity labels on the entity
Binding: All Security Labels (extensible): Security Labels from the Healthcare Privacy and Security Classification System.


..... name ΣC0..1stringDescriptor for entity
..... description 0..1stringDescriptive text
..... query ΣC0..1base64BinaryQuery parameters
..... detail 0..*BackboneElementAdditional Information about the entity
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
...... type 1..1stringName of the property
...... value[x] 1..1Property value
....... valueStringstring
....... valueBase64Binarybase64Binary
.... entity:transaction C0..1BackboneElementData or objects used
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... what Σ0..1Reference(Resource)Specific instance of resource
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
Slice: Unordered, Open by value:url
...... reference ΣC0..1stringLiteral reference, Relative, internal or absolute URL
...... type Σ0..1uriType the reference refers to (e.g. "Patient")
Binding: ResourceType (extensible): Aa resource (or, for logical models, the URI of the logical model).

...... identifier Σ0..1IdentifierLogical reference, when literal reference is not known
....... id 0..1stringUnique id for inter-element referencing
....... extension 0..*ExtensionAdditional content defined by implementations
Slice: Unordered, Open by value:url
....... use ?!Σ0..1codeusual | official | temp | secondary | old (If known)
Binding: IdentifierUse (required): Identifies the purpose for this identifier, if known .

....... type Σ0..1CodeableConceptDescription of identifier
Binding: Identifier Type Codes (extensible): A coded type for an identifier that can be used to determine which identifier to use for a specific purpose.

....... system Σ0..1uriThe namespace for the identifier value
Example General: http://www.acme.com/identifiers/patient
....... value Σ1..1stringthe value of X-Request-Id
Example General: 123456
....... period Σ0..1PeriodTime period when id is/was valid for use
....... assigner Σ0..1Reference(Organization)Organization that issued id (may be just text)
...... display Σ0..1stringText alternative for the resource
..... type 1..1CodingType of entity involved
Binding: AuditEventEntityType (extensible): Code for the entity type involved in the audit event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... system1..1uriIdentity of the terminology system
Fixed Value: https://profiles.ihe.net/ITI/BALP/CodeSystem/BasicAuditEntityType
...... version0..1stringVersion of the system - if relevant
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: XrequestId
...... display0..1stringRepresentation defined by the system
...... userSelected0..1booleanIf this coding was chosen directly by the user
..... role 0..1CodingWhat role the entity played
Binding: AuditEventEntityRole (extensible): Code representing the role the entity played in the audit event.

..... lifecycle 0..1CodingLife-cycle stage for the entity
Binding: ObjectLifecycleEvents (extensible): Identifier for the data life-cycle stage for the entity.

..... securityLabel 0..*CodingSecurity labels on the entity
Binding: All Security Labels (extensible): Security Labels from the Healthcare Privacy and Security Classification System.


..... name ΣC0..1stringDescriptor for entity
..... description 0..1stringDescriptive text
..... query ΣC0..1base64BinaryQuery parameters
..... detail 0..*BackboneElementAdditional Information about the entity
...... id 0..1stringUnique id for inter-element referencing
...... extension 0..*ExtensionAdditional content defined by implementations
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
...... type 1..1stringName of the property
...... value[x] 1..1Property value
....... valueStringstring
....... valueBase64Binarybase64Binary
.... entity:query C1..1BackboneElementData or objects used
..... id 0..1stringUnique id for inter-element referencing
..... extension 0..*ExtensionAdditional content defined by implementations
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodingType of entity involved
Binding: AuditEventEntityType (extensible): Code for the entity type involved in the audit event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-entity-type
...... version0..1stringVersion of the system - if relevant
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 2
...... display0..1stringRepresentation defined by the system
...... userSelected0..1booleanIf this coding was chosen directly by the user
..... role 1..1CodingWhat role the entity played
Binding: AuditEventEntityRole (extensible): Code representing the role the entity played in the audit event.


Required Pattern: At least the following
...... id0..1stringUnique id for inter-element referencing
...... extension0..*ExtensionAdditional content defined by implementations
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/object-role
...... version0..1stringVersion of the system - if relevant
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 24
...... display0..1stringRepresentation defined by the system
...... userSelected0..1booleanIf this coding was chosen directly by the user
..... securityLabel 0..*Codingmay contain the security labels on the Bundle search set returned
Binding: All Security Labels (extensible): Security Labels from the Healthcare Privacy and Security Classification System.


..... name ΣC0..1stringDescriptor for entity
..... description 0..1stringDescriptive text
..... query ΣC1..1base64BinaryQuery parameters

doco Documentation for this format

Terminology Bindings

PathConformanceValueSet / CodeURI
AuditEvent.languagepreferredCommonLanguages
Additional Bindings Purpose
AllLanguages Max Binding
http://hl7.org/fhir/ValueSet/languages
from the FHIR Standard
AuditEvent.typeextensiblePattern: rest
http://hl7.org/fhir/ValueSet/audit-event-type
from the FHIR Standard
AuditEvent.subtypeextensibleAuditEventSub-Type
http://hl7.org/fhir/ValueSet/audit-event-sub-type
from the FHIR Standard
AuditEvent.subtype:anySearchrequiredAllSearchVS
https://profiles.ihe.net/ITI/BALP/ValueSet/AllSearchVS
from this IG
AuditEvent.actionrequiredPattern: E
http://hl7.org/fhir/ValueSet/audit-event-action|4.0.1
from the FHIR Standard
AuditEvent.outcomerequiredPattern: 0
http://hl7.org/fhir/ValueSet/audit-event-outcome|4.0.1
from the FHIR Standard
AuditEvent.purposeOfEventextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.agent.typeextensibleParticipationRoleType
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent.roleexampleSecurityRoleType
http://hl7.org/fhir/ValueSet/security-role-type
from the FHIR Standard
AuditEvent.agent.mediaextensibleMediaTypeCode
http://hl7.org/fhir/ValueSet/dicm-405-mediatype
from the FHIR Standard
AuditEvent.agent.network.typerequiredAuditEventAgentNetworkType
http://hl7.org/fhir/ValueSet/network-type|4.0.1
from the FHIR Standard
AuditEvent.agent.purposeOfUseextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.agent:client.typeextensiblePattern: 110153
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:client.roleexampleSecurityRoleType
http://hl7.org/fhir/ValueSet/security-role-type
from the FHIR Standard
AuditEvent.agent:client.network.typerequiredAuditEventAgentNetworkType
http://hl7.org/fhir/ValueSet/network-type|4.0.1
from the FHIR Standard
AuditEvent.agent:client.purposeOfUseextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.agent:server.typeextensiblePattern: 110152
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:server.roleexampleSecurityRoleType
http://hl7.org/fhir/ValueSet/security-role-type
from the FHIR Standard
AuditEvent.agent:server.network.typerequiredAuditEventAgentNetworkType
http://hl7.org/fhir/ValueSet/network-type|4.0.1
from the FHIR Standard
AuditEvent.agent:server.purposeOfUseextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.agent:user.typeextensiblePattern: IRCP
http://hl7.org/fhir/ValueSet/participation-role-type
from the FHIR Standard
AuditEvent.agent:user.roleexampleSecurityRoleType
http://hl7.org/fhir/ValueSet/security-role-type
from the FHIR Standard
AuditEvent.agent:user.network.typerequiredAuditEventAgentNetworkType
http://hl7.org/fhir/ValueSet/network-type|4.0.1
from the FHIR Standard
AuditEvent.agent:user.purposeOfUseextensiblePurposeOfUse
http://terminology.hl7.org/ValueSet/v3-PurposeOfUse
AuditEvent.source.typeextensibleAuditEventSourceType
http://hl7.org/fhir/ValueSet/audit-source-type
from the FHIR Standard
AuditEvent.entity.typeextensibleAuditEventEntityType
http://hl7.org/fhir/ValueSet/audit-entity-type
from the FHIR Standard
AuditEvent.entity.roleextensibleAuditEventEntityRole
http://hl7.org/fhir/ValueSet/object-role
from the FHIR Standard
AuditEvent.entity.lifecycleextensibleObjectLifecycleEvents
http://hl7.org/fhir/ValueSet/object-lifecycle-events
from the FHIR Standard
AuditEvent.entity.securityLabelextensibleAll Security Labels
http://hl7.org/fhir/ValueSet/security-labels
from the FHIR Standard
AuditEvent.entity:transaction.what.typeextensibleResourceType
http://hl7.org/fhir/ValueSet/resource-types
AuditEvent.entity:transaction.what.identifier.userequiredIdentifierUse
http://hl7.org/fhir/ValueSet/identifier-use|4.0.1
from the FHIR Standard
AuditEvent.entity:transaction.what.identifier.typeextensibleIdentifier Type Codes
http://hl7.org/fhir/ValueSet/identifier-type
from the FHIR Standard
AuditEvent.entity:transaction.typeextensiblePattern: XrequestId
http://hl7.org/fhir/ValueSet/audit-entity-type
from the FHIR Standard
AuditEvent.entity:transaction.roleextensibleAuditEventEntityRole
http://hl7.org/fhir/ValueSet/object-role
from the FHIR Standard
AuditEvent.entity:transaction.lifecycleextensibleObjectLifecycleEvents
http://hl7.org/fhir/ValueSet/object-lifecycle-events
from the FHIR Standard
AuditEvent.entity:transaction.securityLabelextensibleAll Security Labels
http://hl7.org/fhir/ValueSet/security-labels
from the FHIR Standard
AuditEvent.entity:query.typeextensiblePattern: 2
http://hl7.org/fhir/ValueSet/audit-entity-type
from the FHIR Standard
AuditEvent.entity:query.roleextensiblePattern: 24
http://hl7.org/fhir/ValueSet/object-role
from the FHIR Standard
AuditEvent.entity:query.securityLabelextensibleAll Security Labels
http://hl7.org/fhir/ValueSet/security-labels
from the FHIR Standard

This structure is derived from AuditEvent

Summary

Mandatory: 16 elements (4 nested mandatory elements)
Must-Support: 4 elements
Prohibited: 7 elements

Slices

This structure defines the following Slices:

  • The element AuditEvent.subtype is sliced based on the value of value:$this
  • The element AuditEvent.agent is sliced based on the value of pattern:type
  • The element AuditEvent.entity is sliced based on the value of pattern:type

Differential View

This structure is derived from AuditEvent

NameFlagsCard.TypeDescription & Constraintsdoco
.. AuditEvent 0..*AuditEventEvent record kept for security purposes
... type 1..1CodingType/identifier of event
Required Pattern: At least the following
.... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-event-type
.... code1..1codeSymbol in syntax defined by the system
Fixed Value: rest
... Slices for subtype 1..*CodingMore specific type/id for the event
Slice: Unordered, Open by value:$this
.... subtype:anySearch 1..1CodingMore specific type/id for the event
Binding: all Searches (required)
... action 0..1codeType of action performed during the event
Required Pattern: E
... outcome 1..1codeWhether the event succeeded or failed
Required Pattern: 0
... Slices for agent 2..*BackboneElementActor involved in the event
Slice: Unordered, Open by pattern:type
.... agent:client 1..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110153
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... media 0..0
..... network 1..1BackboneElementLogical network location for application activity
.... agent:server 1..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110152
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... media 0..0
..... network 1..1BackboneElementLogical network location for application activity
.... agent:user 0..1BackboneElementActor involved in the event
..... type 1..1CodeableConceptHow agent participated
Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/v3-ParticipationType
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: IRCP
..... role S0..*CodeableConceptAgent role in the event
..... who 1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... name S0..1stringHuman friendly name for the agent
..... requestor 1..1booleanWhether user is initiator
Required Pattern: true
..... media 0..0
..... network 0..0
..... purposeOfUse S0..*CodeableConceptReason given for this user
... source S1..1BackboneElementAudit Event Reporter
... Slices for entity 1..*BackboneElementData or objects used
Slice: Unordered, Open by pattern:type
.... entity:transaction 0..1BackboneElementData or objects used
..... what
...... identifier
....... value 1..1stringthe value of X-Request-Id
..... type 1..1CodingType of entity involved
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: https://profiles.ihe.net/ITI/BALP/CodeSystem/BasicAuditEntityType
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: XrequestId
.... entity:query 1..1BackboneElementData or objects used
..... what 0..0
..... type 1..1CodingType of entity involved
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-entity-type
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 2
..... role 1..1CodingWhat role the entity played
Required Pattern: At least the following
...... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/object-role
...... code1..1codeSymbol in syntax defined by the system
Fixed Value: 24
..... lifecycle 0..0
..... securityLabel 0..*Codingmay contain the security labels on the Bundle search set returned
..... query 1..1base64BinaryQuery parameters
..... detail 0..0

doco Documentation for this format

Terminology Bindings (Differential)

PathConformanceValueSetURI
AuditEvent.subtype:anySearchrequiredAllSearchVS
https://profiles.ihe.net/ITI/BALP/ValueSet/AllSearchVS
from this IG

Key Elements View

NameFlagsCard.TypeDescription & Constraintsdoco
.. AuditEvent 0..*AuditEventEvent record kept for security purposes
... implicitRules ?!Σ0..1uriA set of rules under which this content was created
... modifierExtension ?!0..*ExtensionExtensions that cannot be ignored
... type Σ1..1CodingType/identifier of event
Binding: AuditEventID (extensible): Type of event.


Required Pattern: At least the following
.... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/audit-event-type
.... code1..1codeSymbol in syntax defined by the system
Fixed Value: rest
... Slices for subtype Σ1..*CodingMore specific type/id for the event
Slice: Unordered, Open by value:$this
Binding: AuditEventSub-Type (extensible): Sub-type of event.


.... subtype:anySearch Σ1..1CodingMore specific type/id for the event
Binding: all Searches (required)
... action Σ0..1codeType of action performed during the event
Binding: AuditEventAction (required): Indicator for type of action performed during the event that generated the event.


Required Pattern: E
... recorded Σ1..1instantTime when the event was recorded
... outcome Σ1..1codeWhether the event succeeded or failed
Binding: AuditEventOutcome (required): Indicates whether the event succeeded or failed.


Required Pattern: 0
... Slices for agent 2..*BackboneElementActor involved in the event
Slice: Unordered, Open by pattern:type
.... agent:All Slices Content/Rules for all slices
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... requestor Σ1..1booleanWhether user is initiator
.... agent:client 1..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110153
..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... requestor Σ1..1booleanWhether user is initiator
..... network 1..1BackboneElementLogical network location for application activity
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... agent:server 1..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://dicom.nema.org/resources/ontology/DCM
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: 110152
..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... requestor Σ1..1booleanWhether user is initiator
..... network 1..1BackboneElementLogical network location for application activity
...... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... agent:user 0..1BackboneElementActor involved in the event
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
..... type 1..1CodeableConceptHow agent participated
Binding: ParticipationRoleType (extensible): The Participation type of the agent to the event.


Required Pattern: At least the following
...... coding1..*CodingCode defined by a terminology system
Fixed Value: (complex)
....... system1..1uriIdentity of the terminology system
Fixed Value: http://terminology.hl7.org/CodeSystem/v3-ParticipationType
....... code1..1codeSymbol in syntax defined by the system
Fixed Value: IRCP
..... role S0..*CodeableConceptAgent role in the event
Binding: SecurityRoleType (example): What security role enabled the agent to participate in the event.


..... who Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)Identifier of who
..... name S0..1stringHuman friendly name for the agent
..... requestor Σ1..1booleanWhether user is initiator
Required Pattern: true
..... purposeOfUse S0..*CodeableConceptReason given for this user
Binding: PurposeOfUse (extensible): The reason the activity took place.


... source S1..1BackboneElementAudit Event Reporter
.... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... observer Σ1..1Reference(PractitionerRole | Practitioner | Organization | Device | Patient | RelatedPerson)The identity of source detecting the event
... Slices for entity C1..*BackboneElementData or objects used
Slice: Unordered, Open by pattern:type
.... entity:All Slices Content/Rules for all slices
..... modifierExtension ?!Σ0..*ExtensionExtensions that cannot be ignored even if unrecognized
.... entity:transaction C0..1BackboneElementData or objects used
..