HL7 Electronic Health Record System Functional Model, Release 2.1.1
2.1.1 - International flag

HL7 Electronic Health Record System Functional Model, Release 2.1.1, published by HL7 International / Electronic Health Records. This guide is not an authorized publication; it is the continuous build for version 2.1.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/mvdzel/ehrsfm-fhir-r5/ and changes regularly. See the Directory of published versions

Requirements: RI.1.1.16.1 Evidence of Record Entry Destruction Event (Function)

Official URL: http://hl7.org/ehrs/uv/ehrsfmr2/Requirements/EHRSFMR2-RI.1.1.16.1 Version: 2.1.1
Standards status: Normative Active as of 2025-10-31 Computable Name: RI_1_1_16_1_Evidence_of_Record_Entry_Destruction_Event

Maintain Evidence of Record Entry Destruction Event

Statement N:

Maintain Evidence of Record Entry Destruction Event

Description I:

Evidence of Record Entry Destruction Event includes key metadata, ensures health record integrity (and trust) and enables record audit.

Criteria N:
RI.1.1.16.1#01
 dependent
SHALL

The system SHALL audit each occurrence when Record Entry content is destroyed according to scope of practice, organizational policy, and/or jurisdictional law.
RI.1.1.16.1#02
SHALL

The system SHALL capture identity of the organization where Record Entry content is destroyed.
RI.1.1.16.1#03
SHALL

The system SHALL capture identity of the patient who is subject of destroyed Record Entry content.
RI.1.1.16.1#04
SHALL

The system SHALL capture a destruction identifier for destroyed Record Entry content (e.g., nursing home inpatient stay from 3/15/2000 thru 6/10/2000).
RI.1.1.16.1#05
SHALL

The system SHALL capture identity of the user destroying Record Entry content.
RI.1.1.16.1#06
SHALL

The system SHALL capture identity of the system application which destroyed Record Entry content.
RI.1.1.16.1#07
SHALL

The system SHALL capture the type of Record Event trigger (i.e., destroy).
RI.1.1.16.1#08
SHALL

The system SHALL capture the date and time Record Entry content is destroyed.
RI.1.1.16.1#09
SHOULD

The system SHOULD capture identity of the location (i.e., network address) where Record Entry content is destroyed.
RI.1.1.16.1#10
MAY

The system MAY capture the rationale for destroying Record Entry content.
RI.1.1.16.1#11
MAY

The system MAY capture the data, document or other identifier for destroyed Record Entry content.
RI.1.1.16.1#12
MAY

The system MAY capture data elements for Record Entry content de-identified.