This page is part of the FHIR Specification (v4.5.0: R5 Preview #3). The current version which supercedes this version is 5.0.0. For a full list of available versions, see the Directory of published versions . Page versions: R5 R4B R4 R3 R2

• Using Codes
• Code Systems
• Value Sets
• Concept Maps
• Identifier Systems

4.4.1.561 Value Set http://hl7.org/fhir/ValueSet/audit-event-sub-type

Security Work Group

Maturity Level: 3

Trial Use

Use Context: Any

This is a value set defined by the FHIR project.

Summary

Defining URL:	http://hl7.org/fhir/ValueSet/audit-event-sub-type
Version:	4.5.0
Name:	AuditEventSub-Type
Title:	Audit Event Sub-Type
Definition:	More detailed code concerning the type of the audit event - defined by DICOM with some additional FHIR, HL7, and other additions.
Committee:	Security Work Group
OID:	2.16.840.1.113883.4.642.3.464 (for OID based terminology systems)
Copyright:	These codes are excerpted from Digital Imaging and Communications in Medicine (DICOM) Standard, Part 16: Content Mapping Resource, Copyright © 2011 by the National Electrical Manufacturers Association. Additional codes added by HL7 FHIR use-case analysis
Source Resource	XML / JSON

This value set is used in the following places:

• Resource: AuditEvent.subtype (Coding / Extensible)

4.4.1.561.1 Content Logical Definition

4.4.1.561.2 Expansion

This expansion generated 20 Aug 2020

This value set contains 76 concepts

Expansion based on:

• DICOM Controlled Terminology Definitions v01 (CodeSystem)
• http://hl7.org/fhir/bundle-type version 4.0.0
• http://hl7.org/fhir/restful-interaction version 4.0.0

Code	System	Display	Definition
110120	http://dicom.nema.org/resources/ontology/DCM	Application Start	Audit event: Application Entity has started
110121	http://dicom.nema.org/resources/ontology/DCM	Application Stop	Audit event: Application Entity has stopped
110122	http://dicom.nema.org/resources/ontology/DCM	Login	Audit event: User login has been attempted
110123	http://dicom.nema.org/resources/ontology/DCM	Logout	Audit event: User logout has been attempted
110124	http://dicom.nema.org/resources/ontology/DCM	Attach	Audit event: Node has been attached
110125	http://dicom.nema.org/resources/ontology/DCM	Detach	Audit event: Node has been detached
110126	http://dicom.nema.org/resources/ontology/DCM	Node Authentication	Audit event: Node Authentication has been attempted
110127	http://dicom.nema.org/resources/ontology/DCM	Emergency Override Started	Audit event: Emergency Override has started
110128	http://dicom.nema.org/resources/ontology/DCM	Network Configuration	Audit event: Network configuration has been changed
110129	http://dicom.nema.org/resources/ontology/DCM	Security Configuration	Audit event: Security configuration has been changed
110130	http://dicom.nema.org/resources/ontology/DCM	Hardware Configuration	Audit event: Hardware configuration has been changed
110131	http://dicom.nema.org/resources/ontology/DCM	Software Configuration	Audit event: Software configuration has been changed
110132	http://dicom.nema.org/resources/ontology/DCM	Use of Restricted Function	Audit event: A use of a restricted function has been attempted
110133	http://dicom.nema.org/resources/ontology/DCM	Audit Recording Stopped	Audit event: Audit recording has been stopped
110134	http://dicom.nema.org/resources/ontology/DCM	Audit Recording Started	Audit event: Audit recording has been started
110135	http://dicom.nema.org/resources/ontology/DCM	Object Security Attributes Changed	Audit event: Security attributes of an object have been changed
110136	http://dicom.nema.org/resources/ontology/DCM	Security Roles Changed	Audit event: Security roles have been changed
110137	http://dicom.nema.org/resources/ontology/DCM	User security Attributes Changed	Audit event: Security attributes of a user have been changed
110138	http://dicom.nema.org/resources/ontology/DCM	Emergency Override Stopped	Audit event: Emergency Override has Stopped
110139	http://dicom.nema.org/resources/ontology/DCM	Remote Service Operation Started	Audit event: Remote Service Operation has Begun
110140	http://dicom.nema.org/resources/ontology/DCM	Remote Service Operation Stopped	Audit event: Remote Service Operation has Stopped
110141	http://dicom.nema.org/resources/ontology/DCM	Local Service Operation Started	Audit event: Local Service Operation has Begun
110142	http://dicom.nema.org/resources/ontology/DCM	Local Service Operation Stopped	Audit event: Local Service Operation Stopped
read	http://hl7.org/fhir/restful-interaction	read	Read the current state of the resource.
vread	http://hl7.org/fhir/restful-interaction	vread	Read the state of a specific version of the resource.
update	http://hl7.org/fhir/restful-interaction	update	Update an existing resource by its id (or create it if it is new).
patch	http://hl7.org/fhir/restful-interaction	patch	Update an existing resource by posting a set of changes to it.
delete	http://hl7.org/fhir/restful-interaction	delete	Delete a resource.
history	http://hl7.org/fhir/restful-interaction	history	Retrieve the change history for a particular resource, type of resource, or the entire system.
history-instance	http://hl7.org/fhir/restful-interaction	history-instance	Retrieve the change history for a particular resource.
history-type	http://hl7.org/fhir/restful-interaction	history-type	Retrieve the change history for all resources of a particular type.
history-system	http://hl7.org/fhir/restful-interaction	history-system	Retrieve the change history for all resources on a system.
create	http://hl7.org/fhir/restful-interaction	create	Create a new resource with a server assigned id.
search	http://hl7.org/fhir/restful-interaction	search	Search a resource type or all resources based on some filter criteria.
search-type	http://hl7.org/fhir/restful-interaction	search-type	Search all resources of the specified type based on some filter criteria.
search-system	http://hl7.org/fhir/restful-interaction	search-system	Search all resources based on some filter criteria.
capabilities	http://hl7.org/fhir/restful-interaction	capabilities	Get a Capability Statement for the system.
transaction	http://hl7.org/fhir/restful-interaction	transaction	Update, create or delete a set of resources as a single transaction.
batch	http://hl7.org/fhir/restful-interaction	batch	perform a set of a separate interactions in a single http operation
operation	http://hl7.org/fhir/restful-interaction	operation	Perform an operation as defined by an OperationDefinition.
document	http://hl7.org/fhir/bundle-type	Document	The bundle is a document. The first resource is a Composition.
message	http://hl7.org/fhir/bundle-type	Message	The bundle is a message. The first resource is a MessageHeader.
transaction	http://hl7.org/fhir/bundle-type	Transaction	The bundle is a transaction - intended to be processed by a server as an atomic commit.
transaction-response	http://hl7.org/fhir/bundle-type	Transaction Response	The bundle is a transaction response. Because the response is a transaction response, the transaction has succeeded, and all responses are error free.
batch	http://hl7.org/fhir/bundle-type	Batch	The bundle is a set of actions - intended to be processed by a server as a group of independent actions.
batch-response	http://hl7.org/fhir/bundle-type	Batch Response	The bundle is a batch response. Note that as a batch, some responses may indicate failure and others success.
history	http://hl7.org/fhir/bundle-type	History List	The bundle is a list of resources from a history interaction on a server.
searchset	http://hl7.org/fhir/bundle-type	Search Results	The bundle is a list of resources returned as a result of a search/query interaction, operation, or message.
collection	http://hl7.org/fhir/bundle-type	Collection	The bundle is a set of resources collected into a single package for ease of distribution that imposes no processing obligations or behavioral rules beyond persistence.
access	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Access/View Record Lifecycle Event	Occurs when an agent causes the system to obtain and open a record entry for inspection or review.
hold	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Add Legal Hold Record Lifecycle Event	Occurs when an agent causes the system to tag or otherwise indicate special access management and suspension of record entry deletion/destruction, if deemed relevant to a lawsuit or which are reasonably anticipated to be relevant or to fulfill organizational policy under the legal doctrine of “duty to preserve”.
amend	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Amend (Update) Record Lifecycle Event	Occurs when an agent makes any change to record entry content currently residing in storage considered permanent (persistent).
archive	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Archive Record Lifecycle Event	Occurs when an agent causes the system to create and move archive artifacts containing record entry content, typically to long-term offline storage.
attest	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Attest Record Lifecycle Event	Occurs when an agent causes the system to capture the agent’s digital signature (or equivalent indication) during formal validation of record entry content.
decrypt	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Decrypt Record Lifecycle Event	Occurs when an agent causes the system to decode record entry content from a cipher.
deidentify	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	De-Identify (Anononymize) Record Lifecycle Event	Occurs when an agent causes the system to scrub record entry content to reduce the association between a set of identifying data and the data subject in a way that might or might not be reversible.
deprecate	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Deprecate Record Lifecycle Event	Occurs when an agent causes the system to tag record entry(ies) as obsolete, erroneous or untrustworthy, to warn against its future use.
destroy	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Destroy/Delete Record Lifecycle Event	Occurs when an agent causes the system to permanently erase record entry content from the system.
disclose	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Disclose Record Lifecycle Event	Occurs when an agent causes the system to release, transfer, provision access to, or otherwise divulge record entry content.
encrypt	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Encrypt Record Lifecycle Event	Occurs when an agent causes the system to encode record entry content in a cipher.
extract	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Extract Record Lifecycle Event	Occurs when an agent causes the system to selectively pull out a subset of record entry content, based on explicit criteria.
link	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Link Record Lifecycle Event	Occurs when an agent causes the system to connect related record entries.
merge	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Merge Record Lifecycle Event	Occurs when an agent causes the system to combine or join content from two or more record entries, resulting in a single logical record entry.
originate	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Originate/Retain Record Lifecycle Event	Occurs when an agent causes the system to: a) initiate capture of potential record content, and b) incorporate that content into the storage considered a permanent part of the health record.
pseudonymize	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Pseudonymize Record Lifecycle Event	Occurs when an agent causes the system to remove record entry content to reduce the association between a set of identifying data and the data subject in a way that may be reversible.
reactivate	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Re-activate Record Lifecycle Event	Occurs when an agent causes the system to recreate or restore full status to record entries previously deleted or deprecated.
receive	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Receive/Retain Record Lifecycle Event	Occurs when an agent causes the system to a) initiate capture of data content from elsewhere, and b) incorporate that content into the storage considered a permanent part of the health record.
reidentify	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Re-identify Record Lifecycle Event	Occurs when an agent causes the system to restore information to data that allows identification of information source and/or information subject.
unhold	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Remove Legal Hold Record Lifecycle Event	Occurs when an agent causes the system to remove a tag or other cues for special access management had required to fulfill organizational policy under the legal doctrine of “duty to preserve”.
report	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Report (Output) Record Lifecycle Event	Occurs when an agent causes the system to produce and deliver record entry content in a particular form and manner.
restore	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Restore Record Lifecycle Event	Occurs when an agent causes the system to recreate record entries and their content from a previous created archive artefact.
transform	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Transform/Translate Record Lifecycle Event	Occurs when an agent causes the system to change the form, language or code system used to represent record entry content.
transmit	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Transmit Record Lifecycle Event	Occurs when an agent causes the system to send record entry content from one (EHR/PHR/other) system to another.
unlink	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Unlink Record Lifecycle Event	Occurs when an agent causes the system to disconnect two or more record entries previously connected, rendering them separate (disconnected) again.
unmerge	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Unmerge Record Lifecycle Event	Occurs when an agent causes the system to reverse a previous record entry merge operation, rendering them separate again.
verify	http://terminology.hl7.org/CodeSystem/iso-21089-lifecycle	Verify Record Lifecycle Event	Occurs when an agent causes the system to confirm compliance of data or data objects with regulations, requirements, specifications, or other imposed conditions based on organizational policy.

See the full registry of value sets defined as part of FHIR.

Explanation of the columns that may appear on this page: