HL7 Czech Health information exchange Implementation Guide
0.0.1 - ci-build

HL7 Czech Health information exchange Implementation Guide, published by HL7 Czech Republic. This guide is not an authorized publication; it is the continuous build for version 0.0.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7-cz/HIE/ and changes regularly. See the Directory of published versions

## CZ:ATC Audit Event Content Profiles (ATNA)

There are four different categories of Audit Events in the context of the EPR:

1. Document management (e.g. a document has been uploaded to the EPR of a patient or a list of document metadata has been retrieved)
2. Policy management (e.g. a patient has given a healthcare professional access rights to his EPR)
3. Access Patient Audit Record Repository by a patient or representative (a patient viewed the Audit Trail for the Audit Record Repository)
4. Notification of the patient about the entry of healthcare professionals into a group

Each category is described as a content profile. These content profiles are based on the AuditEvent Resource, http://hl7.org/fhir/R4/auditevent.html.

The AuditEvent Resource has mapping rules to the DICOM audit message format, which allows to map to ATNA.

### Audit Trail Consumption Event Types

The following Audit Trail Consumption Event Types are defined and shall be supported.

Type | Description | Profile Ref | Opt Community
--- | --- | --- | ---
ATC_DOC_CREATE | Document upload | Document Audit Event Content Profile | R
ATC_DOC_READ | Document retrieval | Document Audit Event Content Profile | R
ATC_DOC_UPDATE | Document or Document Metadata update | Document Audit Event Content Profile | R
ATC_DOC_DELETE | Document removal | Document Audit Event Content Profile | R
ATC_DOC_SEARCH | Document search | Document Audit Event Content Profile | R
ATC_POL_CREATE_AUT_PART_AL | Authorize participants to access level/date | Policy Audit Event Content Profile | R, (NP if not reference community)
ATC_POL_UPDATE_AUT_PART_AL | Update access level/date of authorized participants | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_REMOVE_AUT_PART_AL | Remove authorization for participants | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_DEF_CONFLEVEL | Set or update default Confidentiality Level | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_DIS_EMER_USE | Disabling Emergency Access | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_ENA_EMER_USE | Enabling Emergency Access | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_INCL_BLACKLIST | Assign Healthcare Professional to Blacklist | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_POL_EXL_BLACKLIST | Exclude Healthcare Professional from Blacklist | Policy Audit Event Content Profile | R, (NP: if not reference community)
ATC_LOG_READ | Accessing Patient Audit Record Repository | Access Audit Trail Content Profile | R
ATC_HPD_GROUP_ENTRY_NOTIFY | Entry of healthcare professionals into a group | HPD Group Entry Audit Event Content Profile | R, (NP: if not reference community)

Table 1: Audit Trail Consumption Event Types

### Document Audit Event Content Profile

This content profile describes Audit Event related to Document Management. The following Data Elements shall be provided:

Data Element | Description | Property/Value
Event Type | Document upload Document retrieval Document or Document Metadata update Document removal Document search
Event Date and Time |  | FHIR instant
Participants |  |
Initiator | Patient | Name RID
Representative of patient | Name RID
Authorized Healthcare Professional | Name KRPZ
Assistant of a Healthcare Professional | Name KRPZ
Technical User | Name Identifier
Document Administrator | Name KRPZ
Responsible[2.1] | Patient | Name RID
Healthcare Professional | Name KRPZ
Groups where Healthcare Professional is member |  | Name of Group KRPZS
Purpose of Use |  | NORM, EMER, AUTO, DICOM_AUTO
Patient | Involved patient | RID
Document[2.2] | type of document | typeCode (SNOMED CT code)
reference to document | uniqueId repositoryUniqueId homeCommunityID
title of document | title

[2.1] If different from Initiator (Representative of patient acting on behalf of a patient then patient is responsible).

[2.2] Required for Document upload, Document retrieval, Document or Document Metadata update and Document removal but not for Document search.

Table 2: Document Audit Event Data Elements

This profile defines the content of the document audit events which a community has to provide for a patient's audit trail. This profile builds on AuditEvent (http://hl7.org/fhir/R4/auditevent.html).

#### Examples

It will be added

### Policy Audit Event Content Profile

This content profile describes Audit Events related to Policy Management. The following Data Elements shall be provided:

Data Element | Description | Property/Value
Event Type | Authorize participants to access level/date
Update access level/date of authorized participants
Remove authorization for participants to access level/date
Set or update the default Confidentiality Level for new documents
Disabling Emergency Access
Enabling Emergency Access
Exclude a Healthcare Professional from accessing the EPR
Revoke the exclusion of a Healthcare Professional from accessing the EPR
Event Date Time |  | FHIR instant
Participants |  |
Initiator | Patient | Name RID
Representative of patient | Name RID
Authorized Healthcare Professional[3.1] | Name KRPZ
Assistant of a Healthcare Professional | Name KRPZ
Policy Administrator | Name KRPZ
Responsible | Patient | Name RID
Healthcare Professional | Name KRPZ
Patient | Involved patient | RID
Resource | Resource Role | HCP, GRP or REP
Healthcare Professional | Name KRPZ
Group of Healthcare Professional | Name of Group KRPZS
Representative of patient | Name RID
AccessLevel[3.2] | one of urn:e-health-suisse:2015:policies:access-level: normal, restricted, delegation-and-restricted, delegation-and-normal, full
AccessLimitedToDate[3.2] | Date
ProvideLevel[3.3] | one of urn:e-health-suisse:2015:policies:provide-level: normal, restricted, secret

[3.1] Healthcare Professional or Assistant of Healthcare Professional can only be a participant for the first Event Type (Authorize participants to access level).

[3.2] Access Level and the date if the access is limited (AccessLimitedToDate) are required for the first two Event Types (Authorize, update Authorization participants to access level/date), for the other Event Types these parameters do not need to be specified.

[3.3] Provide Level is only relevant for the Event Type Default Confidentiality Level for new Documents.

Table 3: Policy Audit Event Data Elements

This content profile defines the document audit events which a community has to provide for a patients audit trail. This profile builds on AuditEvent (http://hl7.org/fhir/R4/auditevent.html).

#### Examples

It will be added

### Access Audit Trail Content Profile

This content profile describes Audit Event related to Accessing the Audit Trail of a Patient from a Patient Audit Record Repository. The following Data Elements shall be provided:

Data Element | Description | Property/Value
Event Type |  | Access Audit Trail
Event Date and Time |  | FHIR instant
Participants |  |
Initiator | Patient | Name RID
Representative of patient | Name RID
Responsible | Patient | Name RID
Patient | Involved patient | RID

Table 11: Access Audit Trail Data Elements

This content profile defines the access audit trail event, which a community has to provide for a patient’s audit trail. This profile builds on AuditEvent (http://hl7.org/fhir/R4/auditevent.html).

#### Example

It will be added

### HPD Group Entry Audit Event Content Profile

This content profile describe the Audit Event related to the entry of a healthcare professional into a HPD group for which the patient is notified. The following Data Elements shall be provided:

Data Element | Description | Property/Value
Event Type | Patient notified of Healthcare Professionals added to a group
Event Date and Time |  | FHIR instant
Notification Service |  | Name RID
Patient | Notified patient | RID
Healthcare Professionals | Healthcare professionals | Name KRPZ
Group | Group where Healthcare Professionals are added as members | Name of Group KRPZS

Table 13: HPD Group Entry Audit Event Elements

This profile defines the content of the HPD group entry audit event. This profile builds on AuditEvent (http://hl7.org/fhir/R4/auditevent.html).

#### Example

It will be added