FoundationThis is the Continuous Integration Build of FHIR (will be incorrect/inconsistent at times).
See the Directory of published versions
| Responsible Owner: Security Work Group | Standards Status: Informative | Compartments: Device, Group, Patient, Practitioner |
ShEx statement for auditevent
PREFIX fhir: <http://hl7.org/fhir/>
PREFIX fhirvs: <http://hl7.org/fhir/ValueSet/>
PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
# ShEx Version 2.2
IMPORT <Uri.shex>
IMPORT <Code.shex>
IMPORT <Time.shex>
IMPORT <Group.shex>
IMPORT <Range.shex>
IMPORT <Ratio.shex>
IMPORT <Period.shex>
IMPORT <Coding.shex>
IMPORT <Device.shex>
IMPORT <String.shex>
IMPORT <Instant.shex>
IMPORT <Patient.shex>
IMPORT <Boolean.shex>
IMPORT <Integer.shex>
IMPORT <DateTime.shex>
IMPORT <CareTeam.shex>
IMPORT <Location.shex>
IMPORT <Endpoint.shex>
IMPORT <Resource.shex>
IMPORT <Quantity.shex>
IMPORT <Reference.shex>
IMPORT <Encounter.shex>
IMPORT <Organization.shex>
IMPORT <Practitioner.shex>
IMPORT <Base64Binary.shex>
IMPORT <RelatedPerson.shex>
IMPORT <DomainResource.shex>
IMPORT <CodeableConcept.shex>
IMPORT <BackboneElement.shex>
IMPORT <DeviceDefinition.shex>
IMPORT <PractitionerRole.shex>
IMPORT <HealthcareService.shex>
start=@<AuditEvent> AND {fhir:nodeRole [fhir:treeRoot]}
# Record of an event
<AuditEvent> EXTENDS @<DomainResource> CLOSED {
a [fhir:AuditEvent]?;fhir:nodeRole [fhir:treeRoot]?;
fhir:type @<CodeableConcept>; # High level categorization of audit
# event
fhir:subtype @<OneOrMore_CodeableConcept>?; # Specific type of event
fhir:action @<Code> AND
{fhir:v @fhirvs:audit-event-action}?; # Type of action performed during
# the event
fhir:severity @<Code> AND
{fhir:v @fhirvs:audit-event-severity}?; # emergency | alert | critical |
# error | warning | notice |
# informational | debug
fhir:occurred @<Period> OR
@<DateTime> ?; # When the activity occurred
fhir:recorded @<Instant>; # Time when the event was recorded
fhir:outcome @<AuditEvent.outcome>?; # Whether the event succeeded or
# failed
fhir:authorization @<OneOrMore_CodeableConcept>?; # Authorization related to the event
fhir:basedOn @<OneOrMore_Reference_Resource>?; # Workflow authorization within
# which this event occurred
fhir:patient @<Reference> AND {fhir:l
@<Patient> ? }?; # The patient is the subject of the
# data used/created/updated/deleted
# during the activity
fhir:encounter @<Reference> AND {fhir:l
@<Encounter> ? }?; # Encounter within which this event
# occurred or which the event is
# tightly associated
fhir:agent @<OneOrMore_AuditEvent.agent>; # Actor involved in the event
fhir:source @<AuditEvent.source>; # Audit Event Reporter
fhir:entity @<OneOrMore_AuditEvent.entity>?; # Data or objects used
}
# Whether the event succeeded or failed
<AuditEvent.outcome> EXTENDS @<BackboneElement> CLOSED {
fhir:code @<Coding>; # Whether the event succeeded or
# failed
fhir:detail @<OneOrMore_CodeableConcept>?; # Additional outcome detail
}
# Actor involved in the event
<AuditEvent.agent> EXTENDS @<BackboneElement> CLOSED {
fhir:type @<CodeableConcept>?; # How agent participated
fhir:role @<OneOrMore_CodeableConcept>?; # Agent role in the event
fhir:who @<Reference> AND {fhir:l
@<CareTeam> OR
@<Device> OR
@<DeviceDefinition> OR
@<Group> OR
@<HealthcareService> OR
@<Organization> OR
@<Patient> OR
@<Practitioner> OR
@<PractitionerRole> OR
@<RelatedPerson> ? }; # Identifier of who
fhir:requestor @<Boolean>?; # Whether user is initiator
fhir:location @<Reference> AND {fhir:l
@<Location> ? }?; # The agent location when the event
# occurred
fhir:policy @<OneOrMore_Uri>?; # Policy that authorized the agent
# participation in the event
fhir:network (@<Reference> AND {fhir:l @<Endpoint> }) OR
@<Uri> OR
@<String> ?; # This agent network location for
# the activity
fhir:authorization @<OneOrMore_CodeableConcept>?; # Allowable authorization for this
# agent
}
# Data or objects used
<AuditEvent.entity> EXTENDS @<BackboneElement> CLOSED {
fhir:what @<Reference> AND {fhir:l
@<Resource> ? }?; # Specific instance of resource
fhir:role @<CodeableConcept>?; # What role the entity played
fhir:securityLabel @<OneOrMore_CodeableConcept>?; # Security labels on the entity
fhir:description @<String>?; # Descriptive text
fhir:query @<Base64Binary>?; # Query parameters
fhir:detail @<OneOrMore_AuditEvent.entity.detail>?; # Additional Information about the
# entity
fhir:agent @<OneOrMore_AuditEvent.agent>?; # Entity is attributed to this agent
}
# Audit Event Reporter
<AuditEvent.source> EXTENDS @<BackboneElement> CLOSED {
fhir:site @<Reference> AND {fhir:l
@<Location> ? }?; # Logical source location within the
# enterprise
fhir:observer @<Reference> AND {fhir:l
@<CareTeam> OR
@<Device> OR
@<Organization> OR
@<Patient> OR
@<Practitioner> OR
@<PractitionerRole> OR
@<RelatedPerson> ? }; # The identity of source detecting
# the event
fhir:type @<OneOrMore_CodeableConcept>?; # The type of source where event
# originated
}
# Additional Information about the entity
<AuditEvent.entity.detail> EXTENDS @<BackboneElement> CLOSED {
fhir:type @<CodeableConcept>; # The name of the extra detail
# property
fhir:value @<Quantity> OR
@<CodeableConcept> OR
@<String> OR
@<Boolean> OR
@<Integer> OR
@<Range> OR
@<Ratio> OR
@<Time> OR
@<DateTime> OR
@<Period> OR
@<Base64Binary> ; # Property value
}
#---------------------- Cardinality Types (OneOrMore) -------------------
<OneOrMore_CodeableConcept> CLOSED {
rdf:first @<CodeableConcept> ;
rdf:rest [rdf:nil] OR @<OneOrMore_CodeableConcept>
}
<OneOrMore_Reference_Resource> CLOSED {
rdf:first @<Reference> AND {fhir:l
@<Resource> } ;
rdf:rest [rdf:nil] OR @<OneOrMore_Reference_Resource>
}
<OneOrMore_AuditEvent.agent> CLOSED {
rdf:first @<AuditEvent.agent> ;
rdf:rest [rdf:nil] OR @<OneOrMore_AuditEvent.agent>
}
<OneOrMore_AuditEvent.entity> CLOSED {
rdf:first @<AuditEvent.entity> ;
rdf:rest [rdf:nil] OR @<OneOrMore_AuditEvent.entity>
}
<OneOrMore_Uri> CLOSED {
rdf:first @<Uri> ;
rdf:rest [rdf:nil] OR @<OneOrMore_Uri>
}
<OneOrMore_AuditEvent.entity.detail> CLOSED {
rdf:first @<AuditEvent.entity.detail> ;
rdf:rest [rdf:nil] OR @<OneOrMore_AuditEvent.entity.detail>
}
#---------------------- Value Sets ------------------------
# Indicator value set for type of action performed during the event that generated the event.
fhirvs:audit-event-action ["C" "R" "U" "D" "E"]
# The severity of the audit entry.
fhirvs:audit-event-severity ["emergency" "alert" "critical" "error" "warning" "notice" "informational" "debug"]
Usage note: every effort has been made to ensure that the ShEx files are correct and useful, but they are not a normative part of the specification.
FHIR ®© HL7.org 2011+. FHIR R6 hl7.fhir.core#6.0.0-ballot3 generated on Thu, Nov 27, 2025 16:53+0000.
Links: Search |
Version History |
Contents |
Glossary |
QA |
Compare to R4 |
Compare to R5 |
Compare to Last Ballot |
|
Propose a change