This page is part of the FHIR Specification (v0.0.82: DSTU 1). The current version which supercedes this version is 5.0.0. For a full list of available versions, see the Directory of published versions

• Content
• Examples
• Formal Definitions
• Mappings
• Profiles

6.7 Resource SecurityEvent - Content

A record of an event made for purposes of maintaining a security log. Typical uses include detection of intrusion attempts and monitoring for inappropriate usage.

6.7.3 Resource Content

<SecurityEvent xmlns="http://hl7.org/fhir"> 
 <!-- from Resource: extension, modifierExtension, language, text, and contained -->
 <event>  <!-- 1..1 What was done -->
  <type><!-- 1..1 CodeableConcept Type/identifier of event --></type>
  <subtype><!-- 0..* CodeableConcept More specific type/id for the event --></subtype>
  <action value="[code]"/><!-- 0..1 Type of action performed during the event -->
  <dateTime value="[instant]"/><!-- 1..1 Time when the event occurred on source -->
  <outcome value="[code]"/><!-- 0..1 Whether the event succeeded or failed -->
  <outcomeDesc value="[string]"/><!-- 0..1 Description of the event outcome -->
 </event>
 <participant>  <!-- 1..* A person, a hardware device or software process -->
  <role><!-- 0..* CodeableConcept User roles (e.g. local RBAC codes) --></role>
  <reference><!--  0..1 Resource(Practitioner|Patient|Device) Direct reference to resource --></reference>
  <userId value="[string]"/><!--  0..1 Unique identifier for the user -->
  <altId value="[string]"/><!-- 0..1 Alternative User id e.g. authentication -->
  <name value="[string]"/><!-- 0..1 Human-meaningful name for the user -->
  <requestor value="[boolean]"/><!-- 1..1 Whether user is initiator -->
  <media><!-- 0..1 Coding Type of media --></media>
  <network>  <!-- 0..1 Logical network location for application activity -->
   <identifier value="[string]"/><!-- 0..1 Identifier for the network access point of the user device -->
   <type value="[code]"/><!-- 0..1 The type of network access point -->
  </network>
 </participant>
 <source>  <!-- 1..1 Application systems and processes -->
  <site value="[string]"/><!-- 0..1 Logical source location within the enterprise -->
  <identifier value="[string]"/><!-- 1..1 The id of source where event originated -->
  <type><!-- 0..* Coding The type of source where event originated --></type>
 </source>
 <object>  <!-- 0..* Specific instances of data or objects that have been accessed -->
  <identifier><!--  0..1 Identifier Specific instance of object (e.g. versioned) --></identifier>
  <reference><!--  0..1 Resource(Any) Specific instance of resource (e.g. versioned) --></reference>
  <type value="[code]"/><!-- 0..1 Object type being audited -->
  <role value="[code]"/><!-- 0..1 Functional application role of Object -->
  <lifecycle value="[code]"/><!-- 0..1 Life-cycle stage for the object -->
  <sensitivity><!-- 0..1 CodeableConcept Policy-defined sensitivity for the object --></sensitivity>
  <name value="[string]"/><!--  0..1 Instance-specific descriptor for Object -->
  <description value="[string]"/><!-- 0..1 Descriptive text -->
  <query value="[base64Binary]"/><!--  0..1 Actual query for object -->
  <detail>  <!-- 0..* Additional Information about the Object -->
   <type value="[string]"/><!-- 1..1 Name of the property -->
   <value value="[base64Binary]"/><!-- 1..1 Property value -->
  </detail>
 </object>
</SecurityEvent>

Alternate definitions: Schema/Schematron, Resource Profile

6.7.3.1 Terminology Bindings

6.7.3.2 Constraints

• Inv-3: On SecurityEvent.participant: Either a userId or a reference, but not both (xpath on f:SecurityEvent/f:participant: exists(f:userId) != exists(f:reference))
• Inv-1: On SecurityEvent.object: Either a name or a query (or both) (xpath on f:SecurityEvent/f:object: not(exists(f:name)) or not(exists(f:query)))
• Inv-2: On SecurityEvent.object: Either an identifier or a reference, but not both (xpath on f:SecurityEvent/f:object: exists(f:identifier) != exists(f:reference))

6.7.3.3 Using Coded Values

The security event resource and the ATNA Audit record are used in many contexts through healthcare. The coded values defined in the "extensible" bindings above are those widely used and/or defined by DICOM, IHE or ISO, who all defined these codes to meet very specific use cases. These codes should be used when the are suitable, or other codes can be defined.

The set of codes defined for this resource are expected to grow over time, and additional codes may be proposed / requested using the community input link above.

6.7.3.4 Event codes for Common Scenarios

This table summarizes common event scenarios, and the codes that should be used for each case.

Security Event Actions for RESTful operations:

6.7.4 Search Parameters

Search parameters for this resource. The standard parameters also apply. See Searching for more information about searching in REST, messaging, and services.