# TI.2.1.2 Security Audit Triggers (Function) - HL7 Electronic Health Record System Functional Model, Release 2.1.1 v2.1.1

## Requirements: TI.2.1.2 Security Audit Triggers (Function) 

 
Manage Security Audit Triggers 



## Resource Content

```json
{
  "resourceType" : "Requirements",
  "id" : "EHRSFMR2-TI.2.1.2",
  "meta" : {
    "profile" : [
      "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/FMFunction"
    ]
  },
  "language" : "en",
  "extension" : [
    {
      "url" : "http://hl7.org/fhir/StructureDefinition/structuredefinition-standards-status",
      "valueCode" : "normative"
    },
    {
      "url" : "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode" : "ehr"
    }
  ],
  "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-TI.2.1.2",
  "version" : "2.1.1",
  "name" : "TI_2_1_2_Security_Audit_Triggers",
  "title" : "TI.2.1.2 Security Audit Triggers (Function)",
  "status" : "active",
  "date" : "2025-12-13T09:06:06+00:00",
  "publisher" : "HL7 International / Electronic Health Records",
  "contact" : [
    {
      "telecom" : [
        {
          "system" : "url",
          "value" : "http://www.hl7.org/Special/committees/ehr"
        }
      ]
    }
  ],
  "description" : "Manage Security Audit Triggers",
  "jurisdiction" : [
    {
      "coding" : [
        {
          "system" : "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code" : "001",
          "display" : "World"
        }
      ]
    }
  ],
  "purpose" : "Security Audit Triggers are designed to capture security related events, both routine and exceptional, including key metadata (who, what, when, where, why).",
  "statement" : [
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : false
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-01",
      "label" : "TI.2.1.2#01",
      "conformance" : ["SHALL"],
      "conditionality" : false,
      "requirement" : "The system SHALL provide the ability to enter the reason that access control functions are being overridden."
    },
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : true
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-02",
      "label" : "TI.2.1.2#02",
      "conformance" : ["SHALL"],
      "conditionality" : false,
      "requirement" : "The system SHALL audit key events according to scope of practice, organizational policy, and/or jurisdictional law."
    },
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : true
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-03",
      "label" : "TI.2.1.2#03",
      "conformance" : ["SHALL"],
      "conditionality" : false,
      "requirement" : "The system SHALL capture key Audit Metadata at each Audit Trigger according to scope of practice, organizational policy, and/or jurisdictional law.",
      "derivedFrom" : "EHR-S_FM_R1.1 IN.2.2#1"
    },
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : true
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-04",
      "label" : "TI.2.1.2#04",
      "conformance" : ["SHALL"],
      "conditionality" : false,
      "requirement" : "The system SHALL capture an Audit Log Entry at each Audit Trigger according to scope of practice, organizational policy, and/or jurisdictional law.",
      "derivedFrom" : "EHR-S_FM_R1.1 IN.2.2#12"
    },
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : false
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-05",
      "label" : "TI.2.1.2#05",
      "conformance" : ["SHALL"],
      "conditionality" : false,
      "requirement" : "The system SHALL provide the ability to log system maintenance events for entry to, and exit from, the EHR system.",
      "derivedFrom" : "EHR-S_FM_R1.1 IN.2.2#22"
    },
    {
      "extension" : [
        {
          "url" : "http://hl7.org/ehrs/uv/ehrsfmr2/StructureDefinition/requirements-dependent",
          "valueBoolean" : false
        }
      ],
      "key" : "EHRSFMR2-TI.2.1.2-06",
      "label" : "TI.2.1.2#06",
      "conformance" : ["MAY"],
      "conditionality" : false,
      "requirement" : "The system MAY capture an Audit Log Entry at each Audit Trigger using a common audit engine, e.g., standards-based software.",
      "derivedFrom" : "EHR-S_FM_R1.1 IN.2.2#23"
    }
  ]
}

```
