This is the Continuous Integration Build of FHIR (will be incorrect/inconsistent at times).
See the Directory of published versions 
Responsible Owner: Security Work Group |
Informative | Use Context: Country: World |
Official URL: http://hl7.org/fhir/ValueSet/audit-event-sub-type-example
|
Version: 6.0.0-ballot3 | |||
| active as of 2025-11-01 | Computable Name: AuditEventSubTypeExample | |||
| Flags: | OID: 2.16.840.1.113883.4.642.3.464 | |||
This value set is used in the following places:
Example values for more detailed code concerning the type of the audit event - defined by DICOM with some additional FHIR, HL7, and other additions.
Generated Narrative: ValueSet audit-event-sub-type-example
Last updated: 2025-11-20T23:56:49.898Z
This value set includes codes based on the following rules:
http://dicom.nema.org/resources/ontology/DCM
version 📦2025.3.20250714, where the codes are contained in AuditEventTypeCode 
http://dicom.nema.org/resources/ontology/DCM
version 📦2025.3.20250714, where the codes are contained in SecurityAlertTypeCode 
http://hl7.org/fhir/restful-interaction version 📦6.0.0-ballot3
This expansion generated 20 Nov 2025
ValueSet
Expansion performed internally based on:
This value set contains 53 concepts
| System | Code | Display | Definition |
http://dicom.nema.org/resources/ontology/DCM |
110120 ![]() |
Application Start | Audit event: Application Entity has started. |
http://dicom.nema.org/resources/ontology/DCM |
110121 ![]() |
Application Stop | Audit event: Application Entity has stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110122 ![]() |
Login | Audit event: User login has been attempted. |
http://dicom.nema.org/resources/ontology/DCM |
110123 ![]() |
Logout | Audit event: User logout has been attempted. |
http://dicom.nema.org/resources/ontology/DCM |
110124 ![]() |
Attach | Audit event: Node has been attached. |
http://dicom.nema.org/resources/ontology/DCM |
110125 ![]() |
Detach | Audit event: Node has been detached. |
http://dicom.nema.org/resources/ontology/DCM |
110126 ![]() |
Node Authentication | Audit event: Node Authentication has been attempted. |
http://dicom.nema.org/resources/ontology/DCM |
110127 ![]() |
Emergency Override Started | Audit event: Emergency Override has started. |
http://dicom.nema.org/resources/ontology/DCM |
110128 ![]() |
Network Configuration | Audit event: Network configuration has been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110129 ![]() |
Security Configuration | Audit event: Security configuration has been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110130 ![]() |
Hardware Configuration | Audit event: Hardware configuration has been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110131 ![]() |
Software Configuration | Audit event: Software configuration has been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110132 ![]() |
Use of Restricted Function | Audit event: A use of a restricted function has been attempted. |
http://dicom.nema.org/resources/ontology/DCM |
110133 ![]() |
Audit Recording Stopped | Audit event: Audit recording has been stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110134 ![]() |
Audit Recording Started | Audit event: Audit recording has been started. |
http://dicom.nema.org/resources/ontology/DCM |
110135 ![]() |
Object Security Attributes Changed | Audit event: Security attributes of an object have been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110136 ![]() |
Security Roles Changed | Audit event: Security roles have been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110137 ![]() |
User security Attributes Changed | Audit event: Security attributes of a user have been changed. |
http://dicom.nema.org/resources/ontology/DCM |
110138 ![]() |
Emergency Override Stopped | Audit event: Emergency Override has Stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110139 ![]() |
Remote Service Operation Started | Audit event: Remote Service Operation has Begun. |
http://dicom.nema.org/resources/ontology/DCM |
110140 ![]() |
Remote Service Operation Stopped | Audit event: Remote Service Operation has Stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110141 ![]() |
Local Service Operation Started | Audit event: Local Service Operation has Begun. |
http://dicom.nema.org/resources/ontology/DCM |
110142 ![]() |
Local Service Operation Stopped | Audit event: Local Service Operation Stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110143 ![]() |
Authentication Decision | Audit event: An authentication decision has been made. |
http://dicom.nema.org/resources/ontology/DCM |
110144 ![]() |
Authorization Decision | Audit event: An authorization decision has been made. |
http://dicom.nema.org/resources/ontology/DCM |
110145 ![]() |
Session start | Audit event: A persistent session has started. |
http://dicom.nema.org/resources/ontology/DCM |
110146 ![]() |
Session stop | Audit event: A persistent session has stopped. |
http://dicom.nema.org/resources/ontology/DCM |
110147 ![]() |
Access Control Decision | Audit event: An access control decision has been made. |
http://hl7.org/fhir/restful-interaction |
read | read | Read the current state of the resource. |
http://hl7.org/fhir/restful-interaction |
vread | vread | Read the state of a specific version of the resource. |
http://hl7.org/fhir/restful-interaction |
update | update | Update an existing resource by its id (or create it if it is new). |
http://hl7.org/fhir/restful-interaction |
update-conditional | update-conditional | Update an existing resource based on some identification criteria (or create it if it is new). |
http://hl7.org/fhir/restful-interaction |
patch | patch | Update an existing resource by posting a set of changes to it. |
http://hl7.org/fhir/restful-interaction |
patch-conditional | patch-conditional | Update an existing resource, based on some identification criteria, by posting a set of changes to it. |
http://hl7.org/fhir/restful-interaction |
delete | delete | Delete a resource. |
http://hl7.org/fhir/restful-interaction |
delete-conditional-single | delete-conditional-single | Delete a single resource based on some identification criteria. |
http://hl7.org/fhir/restful-interaction |
delete-conditional-multiple | delete-conditional-multiple | Delete one or more resources based on some identification criteria. |
http://hl7.org/fhir/restful-interaction |
delete-history | delete-history | Delete all historical versions of a resource. |
http://hl7.org/fhir/restful-interaction |
delete-history-version | delete-history-version | Delete a specific version of a resource. |
http://hl7.org/fhir/restful-interaction |
history | history | Retrieve the change history for a particular resource, type of resource, or the entire system. |
http://hl7.org/fhir/restful-interaction |
history-instance | history-instance | Retrieve the change history for a particular resource. |
http://hl7.org/fhir/restful-interaction |
history-type | history-type | Retrieve the change history for all resources of a particular type. |
http://hl7.org/fhir/restful-interaction |
history-system | history-system | Retrieve the change history for all resources on a system. |
http://hl7.org/fhir/restful-interaction |
create | create | Create a new resource with a server assigned id. |
http://hl7.org/fhir/restful-interaction |
create-conditional | create-conditional | Create a new resource with a server assigned id if an equivalent resource does not already exist. |
http://hl7.org/fhir/restful-interaction |
search | search | Search a resource type or all resources based on some filter criteria. |
http://hl7.org/fhir/restful-interaction |
search-type | search-type | Search all resources of the specified type based on some filter criteria. |
http://hl7.org/fhir/restful-interaction |
search-system | search-system | Search all resources based on some filter criteria. |
http://hl7.org/fhir/restful-interaction |
search-compartment | search-compartment | Search resources in a compartment based on some filter criteria. |
http://hl7.org/fhir/restful-interaction |
capabilities | capabilities | Get a Capability Statement for the system. |
http://hl7.org/fhir/restful-interaction |
transaction | transaction | Update, create or delete a set of resources as a single transaction. |
http://hl7.org/fhir/restful-interaction |
batch | batch | perform a set of a separate interactions in a single http operation |
http://hl7.org/fhir/restful-interaction |
operation | operation | Perform an operation as defined by an OperationDefinition. |
See the full registry of value sets defined as part of FHIR.
Explanation of the columns that may appear on this page:
| Lvl | A few code lists that FHIR defines are hierarchical - each code is assigned a level. For value sets, levels are mostly used to organize codes for user convenience, but may follow code system hierarchy - see Code System for further information |
| Source | The source of the definition of the code (when the value set draws in codes defined elsewhere) |
| Code | The code (used as the code in the resource instance). If the code is in italics, this indicates that the code is not selectable ('Abstract') |
| Display | The display (used in the display element of a Coding). If there is no display, implementers should not simply display the code, but map the concept into their application |
| Definition | An explanation of the meaning of the concept |
| Comments | Additional notes about how to use the code |