_lastUpdated

Format: GET [base]/AuditEvent?_lastUpdated=<operator><dateandtime>

Supported prefixes/operators:

• le (lesser than or equal to

• ge (greater than or equal to)

• lt (lesser than)

• gt (greater than)

You can combine them to filter by a range. See example.
It is also valid to enter only a date without a time.

Additional information about searching in FHIR by date: https://www.hl7.org/fhir/search.html#date

Note: If you fill in only the date without the time, the time will be assumed to be 00:00:00. This is not according to the FHIR standards (there it would filter by the whole day instead of according to midnight), but due to a lack of time is not supported correctly at the moment. This can be enhanced in the future.

No filtration according to lastUpdated.

Get the all audit event resources which has a recorded field with a time later or equal to 2019-12-12 08:00:00:

GET http://fhir.example.com/AuditEvent?_lastUpdated=ge2019-12-12T08:00:00

Get all the audit event resources which were last updated with a time between and including: 01.10.2019 10:00-01.01.2020 00:00

GET http://fhir.example.com/AuditEvent?_lastUpdated=ge2019-10-01-10:00&_lastUpdated=le2020-01-01-10:00:00

GET http://fhir.example.com/AuditEvent?_lastUpdated=gt2019-10-01&_lastUpdated=lt2020-01-01-10:00:00

entity:Patient.identifier

Limit results to the specified MR Number.
Note: this might result in multiple patient files being returned since the MR# can be shared.

The search parameter needs to specify the entity type as Patient, and then specify that we are looking for a matching identifier (as opposed to unique ID.)
The entity type should be specified because entity supports referring to a lot of different types of resources (e.g. PractitionerRole, Practitioner, Patient, etc…)

Format:

<span class="inline-comment-marker" data-ref="b8611599-15f6-4822-a9b3-57639cd707e0">GET [base]/AuditEvent?entity:Patient.identifier=<MR #></span>

No filtration by MR number / hospital number.

Get all the audit event resources with a recorded Patient-type entity with an identifier of 4947634.

http://hapi.fhir.org/baseR4/AuditEvent?entity:Patient.identifier=49476534

_count

An integer which is 1 or greater should be specified. (Although 0 is supported by FHIR, it will not be implemented at this time.)

The supported range will be from 1 to 2000

If count is specified, then the number of results will be limited per page, and “next” and “last” page links will be added to the page to allow browsing to the following or last page. A total number will also be displayed in the total field.

Please see Supporting Paging in FHIR Audit Event for more information on how the bundle is changed as a result of this search parameter.

Format:

GET [base]/AuditEvent?_count=<maximum results per page>

Specifying a count is not mandatory, but if the count is not specified, a default of “2000” will be entered.

GET http://fhir.example.com/AuditEvent?_count=1500

AuditEvent

0

Event record kept for security purposes

AuditEvent.contained

0

Resource

Contained, inline Resources

For the generic profile, there will not be any contained resources.

AuditEvent.type

1

1

Coding

Type/identifier of event

If Source of Access = emergency access, then the type should be treated as emergency access. Otherwise, it should be treated as a normal patient record access.

• system = http://dicom.nema.org/resources/ontology/DCM

If it's not emergency access then hardcoded values:

• code = 110110

• display = Patient Record

If it is emergency access then hardcoded values:

• code = 110113

• display = Security Alert

AuditEvent.type.system

0

1

uri

http://dicom.nema.org/resources/ontology/DCM

Identity of the terminology system

AuditEvent.type.code

0

1

code

Symbol in syntax defined by the system

AuditEvent.type.display

0

1

string

Representation defined by the system

AuditEvent.subtype

0

Coding

More specific type/id for the event

If Source of Access = emergency access, then the subtype should be treated as emergency access. Otherwise, there should be no subtype.

If it is emergencyAccess then hardcoded values:
system = http://dicom.nema.org/resources/ontology/DCM
code = 110127
display = Emergency Override Started

Otherwise, nothing.

AuditEvent.subtype.system

0

1

uri

Identity of the terminology system

AuditEvent.subtype.code

0

1

code

Symbol in syntax defined by the system

AuditEvent.subtype.display

0

1

string

Representation defined by the system

AuditEvent.action

0

1

code

Type of action performed during the event

When the access is conducted by a user the value shall always be empty.

When the access is conducted by an interface this value will be whatever the interface specified and saved. (It should be either C, R, U, or D according to the CRUD coding system.)

Taken from UsersPatientsLog from the APIMethod column. The database value is the HTTP verb, and must be converted according to the following guidelines to determine the CRUD value:

• Post = C

• Get = R

• Put or Patch = U

• Delete = D

AuditEvent.recorded

1

1

instant

Time when the event was recorded

Taken from UsersPatientsLog from the “FromTime” column.
Expressed as a dateTime. See: MV API Date & Time Format

AuditEvent.purposeOfEvent

0

CodeableConcept

The purposeOfUse of the event

If Source of Access = emergency access, then the type should be treated as emergency access. Otherwise, it should be treated as a normal patient record access.

• system = http://terminology.hl7.org/CodeSystem/v3-ActReason

In case of emergency access then hardcoded values:

• code = ETREAT

• display = Emergency Treatment

otherwise, hardcoded values:

• code = TREAT

• display = treatment

AuditEvent.purposeOfEvent.coding

0

1

Coding

Code defined by a terminology system

AuditEvent.purposeOfEvent.coding.system

0

1

uri

http://terminology.hl7.org/CodeSystem/v3-ActReason

Identity of the terminology system

AuditEvent.purposeOfEvent.coding.code

0

1

code

Symbol in syntax defined by the system

AuditEvent.purposeOfEvent.coding.display

0

1

string

Representation defined by the system

AuditEvent.agent

1

BackboneElement

Actor involved in the event

AuditEvent.agent.who

0

1

Reference

Identifier of who

Logical reference to user

AuditEvent.agent.who.reference

0

1

string

Literal reference, Relative, internal or absolute URL

• Not used in Generic Profile

AuditEvent.agent.who.type

0

1

uri

Type the reference refers to (e.g. "Patient")

• type = “Practitioner”

• identifier.system = taken from config from the key name “UsersLogin“. See Configuring AuditEvent Coding System (without attributes)
  If no config is defined, the value will be: http://www.imd-soft.com/CodingSystem/Users/Login

• identifier.value = user login

• display = user’s name

AuditEvent.agent.who.identifier

0

1

Identifier

Logical reference, when literal reference is not known

AuditEvent.agent.who.identifier.system

0

1

uri

The namespace for the identifier value

AuditEvent.agent.who.identifier.value

0

1

string

The value that is unique

AuditEvent.agent.who.display

0

1

string

Text alternative for the resource

AuditEvent.agent.requestor

1

1

boolean

Whether user is initiator

"True" when conducted by a normal user, "False" if conducted by a service user. Note: this is a checkbox in the user customization, but the value is the opposite of the checkbox. (If service user = true, then requestor should be false, and vice versa in the opposite case.)

AuditEvent.agent.purposeOfUse

0

CodeableConcept

Reason given for this user

If Source of Access = emergency access, treat it as emergency access. Otherwise, treat it as patient record access.

• system = http://terminology.hl7.org/CodeSystem/v3-ActReason

If emergency access then (generic) hardcoded values:

• code = BTG

• display = break the glass

otherwise (generic) hardcoded values:

• code = TREAT

• display = treatment

AuditEvent.agent.purposeOfUse.coding

0

Coding

Code defined by a terminology system

AuditEvent.agent.purposeOfUse.coding.system

0

1

uri

http://terminology.hl7.org/CodeSystem/v3-ActReason

Identity of the terminology system

AuditEvent.agent.purposeOfUse.coding.code

0

1

code

Symbol in syntax defined by the system

AuditEvent.agent.purposeOfUse.coding.display

0

1

string

Representation defined by the system

AuditEvent.source

1

1

BackboneElement

Audit Event Reporter

AuditEvent.source.site

0

1

string

Logical source location within the enterprise

Will not appear in the general profile

AuditEvent.source.observer

1

1

Reference

The identity of source detecting the event

AuditEvent.source.observer.identifier

0

1

Identifier

Logical reference, when literal reference is not known

AuditEvent.source.observer.identifier.system

0

1

uri

The namespace for the identifier value

Taken from config from the key name DepartmentsExternalCode. See Configuring AuditEvent Coding System (without attributes)
If no config is defined, will be http://www.imd-soft.com/CodingSystem/Departments/ExternalCode

AuditEvent.source.observer.identifier.value

0

1

string

The value that is unique

Taken from patient’s department’s external code at the time of the audit log entry.
If the patient doesn’t yet have a department (according to the patient ownership table), then we will take the first department that we find instead. (Note: this is a scenario that shouldn’t really happen in real life, because you can’t admit patients with an admission date in the future, only current time or past, but it could happen if there is a difference in time between the server and the workstation.)

AuditEvent.source.observer.display

0

1

string

Text alternative for the resource

Department name, taken from the patient’s department’s name at the time of the audit log entry. If the patient doesn’t yet have a department (according to the patient ownership table), then we will take the first department that we find instead. (Note: this is a scenario that shouldn’t really happen in real life, because you can’t admit patients with an admission date in the future, only current time or past, but it could happen if there is a difference in time between the server and the workstation.)
Design note: We have to include this field, because if we don’t, if the department has no external code, we would be left with an invalid AuditEvent because observer would be missing.

AuditEvent.source.type

0

Coding

The type of source where event originated

AuditEvent.source.type.system

0

1

uri

http://terminology.hl7.org/CodeSystem/security-source-type

Identity of the terminology system

Hardcoded value (generic).

AuditEvent.source.type.code

0

1

code

Symbol in syntax defined by the system

Hardcoded values depend on if the user is a Service User or not.

If it is a service user:

• Code 4 = When the access was conducted by a service to service user (e.g. via interface)

If not:

• Code 5 = Access via a user within MV

AuditEvent.source.type.display

0

1

string

Representation defined by the system

Hardcoded values (generic) depend on if the user is a Service User or not.

If it is a service user:

• Display = "Application Server"

If not:

• Display = "Database Server"

AuditEvent.entity

0

BackboneElement

Data or objects used

AuditEvent.entity.what

0

1

Reference

Specific instance of resource

AuditEvent.entity.what.type

0

1

uri

Patient

Type the reference refers to (e.g. "Patient")

Hardcoded to “Patient” (generic)

AuditEvent.entity.what.identifier

0

1

Identifier

Logical reference, when literal reference is not known

AuditEvent.entity.what.identifier.system

0

1

uri

The namespace for the identifier value

Taken from config from the key name MRNumber. See Configuring AuditEvent Coding System (without attributes)
If no config is defined, will be http://www.imd-soft.com/CodingSystem/Patients/MRNumber

AuditEvent.entity.what.identifier.value

0

1

string

The value that is unique

Patient’s MR #.

AuditEvent.entity.type

0

1

Coding

Type of entity involved

If there is no FHIR Type, then:
system = http://terminology.hl7.org/CodeSystem/audit-entity-type
code = 2
display = System Object

If there is a FHIR Type, then:
system = http://hl7.org/fhir/resource-types
code = the FHIRtype value
display = the FHIR Type value

This is a new value which does not exist before 6.15. Taken from UsersPatientsLog from the column ApiPath.
We will check if there is “fhir” in the path and if so, we will cut of the resource name and capitalize the first letter.
For example, a value of “/fhir/r4/observation” will return “Observation”

AuditEvent.entity.type.system

0

1

uri

Identity of the terminology system

AuditEvent.entity.type.code

0

1

code

Symbol in syntax defined by the system

AuditEvent.entity.type.display

0

1

string

Representation defined by the system

AuditEvent.entity.query

0

1

base64Binary

Query parameters

Take the “Query” field (if any is specified).

This is a new value which does not exist before 6.15.
Taken from UsersPatientsLog from the ApiQuery column.

AuditEvent.entity.detail

0

BackboneElement

Additional Information about the entity

In case the request was made via an interface, the interface can place a custom message in the log which is returned in this field.
If there is none, the entire detail section should not appear at all since filling type and value is mandatory if they appear.

If there is a value for “detail”, and it is known that the access was made by an interface, then type should return the hardcoded value “Interface details”.
Otherwise, if it is via the application, and there is a detail valueString, then type should return the hardcoded value “Access details“.
The determination about whether it is application or interface is made by checking if there is a value in the column “ApiEventId“. See also Audit Event Considerations for Developers.

Detail is a new value which does not exist before 6.15.
Taken from UsersPatientsLog from the column ReasonInformation.

AuditEvent.entity.detail.type

1

1

string

Name of the property

AuditEvent.entity.detail.valueString

1

1

string

Property value