HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - Normative

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/ehrsfm-ig/ and changes regularly. See the Directory of published versions

## Requirements: TI.2.1.3 System Audit Triggers (Function)

Official URL: http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-TI.2.1.3 | Version: 2.1.1
Standards status: Normative Active as of 2025-12-13 | Computable Name: TI_2_1_3_System_Audit_Triggers

Manage System Audit Triggers

Description I:

System Audit Triggers are designed to capture system related events, both routine and exceptional, including key metadata (who, what, when, where, why).

Criteria N:

TI.2.1.3#01 | SHOULD | The system SHOULD provide the ability to log system maintenance events for loading new versions of, or changes to, the clinical system.
TI.2.1.3#02 | SHOULD | The system SHOULD provide the ability to store system maintenance events for loading new versions of codes and knowledge bases.
TI.2.1.3#03 | SHOULD | The system SHOULD provide the ability to log system maintenance events for creating and restoring of backup.
TI.2.1.3#04 | SHOULD | The system SHOULD provide the ability to audit events in the case of detection of corrupt or dirty data.
TI.2.1.3#05 | SHALL | The system SHALL provide the ability to audit the access and usage of systems, data, and organizational resources.
TI.2.1.3#06 | SHALL | The system SHALL provide the ability to log system events at the hardware and software architecture level.
TI.2.1.3#07 | SHALL | The system SHALL provide the ability to log system maintenance events for entry to, and exit from, the EHR system.
TI.2.1.3#08 | SHALL | The system SHALL provide the ability to log system maintenance events for remote access connections including those for system support and maintenance activities for security and access purposes.