AuditEvent Profile

Canonical	../StructureDefinition/nexus-emr-core-auditevent
Status	draft (experimental) · 1.26.0
Base	AuditEvent (constraint)
Source	FSH · JSON

Nexus EMR profile for AuditEvent -- the access and activity log: who acted, on which record, when, through what interaction, and with what outcome.

Examples

Audit avery break glass 20260903 · Chart Read Audit Entry · Packet Disclosure Audit Entry

Audit avery break glass 20260903

AuditEvent/audit-avery-break-glass-20260903 — claims conformance to AuditEvent Profile

{
  "resourceType": "AuditEvent",
  "id": "audit-avery-break-glass-20260903",
  "meta": {
    "profile": [
      "../StructureDefinition/nexus-emr-core-auditevent"
    ]
  },
  "text": {
    "status": "generated",
    "div": "<div xmlns='http://www.w3.org/1999/xhtml'><p>Avery Linwood presented unresponsive at 02:14 on 3 September 2026. Dr. Emil Navarro reached her chart under the standing break-glass exception in her whole-record privacy directive.</p><p><strong>This is the record that an override HAPPENED.</strong> The directive says who MAY break the glass; it never says that anybody did, and it is not edited when somebody does. That separation is what keeps &quot;what did the patient actually ask for&quot; answerable - a Consent that accumulated override events would bury the instruction under everything that happened to her since.</p><p><strong>The lawful ground is on <code>agent.purposeOfUse</code>.</strong> <code>OVRER</code> - emergency treatment override - not <code>BTG</code>. BTG on the directive marks WHICH exception was used; the ground here is WHY it was lawful on this occasion, and it is what a privacy office reviews. The four grounds carry different evidence obligations, so recording the nearest-looking one sends the review down the wrong path.</p><p><strong>The directive is named as an entity</strong>, so the review can start from the override and reach the instruction it set aside without reconstructing the link from timestamps.</p><p>Follows IHE BALP's authorization-with-consent pattern. No period is recorded: the window an override is good for is a runtime property of the session, and each subsequent access writes its own entry rather than relying on this one.</p></div>"
  },
  "type": {
    "system": "http://terminology.hl7.org/CodeSystem/audit-event-type",
    "code": "rest",
    "display": "RESTful Operation"
  },
  "subtype": [
    {
      "display": "Consent override invoked"
    }
  ],
  "action": "R",
  "recorded": "2026-09-03T02:14:07-04:00",
  "outcome": "0",
  "agent": [
    {
      "who": {
        "reference": "Practitioner/dr-emil-navarro",
        "display": "Dr. Emil Navarro"
      },
      "altId": "auth0|61a4cd902b17e8443fa9d1c7",
      "name": "enavarro@cedarbrook.example.ca",
      "requestor": true,
      "purposeOfUse": [
        {
          "coding": [
            {
              "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason",
              "code": "OVRER",
              "display": "emergency treatment override"
            }
          ]
        }
      ]
    }
  ],
  "source": {
    "observer": {
      "reference": "Device/cedarbrook-juno-emr",
      "display": "Cedarbrook EMR FHIR API"
    }
  },
  "entity": [
    {
      "what": {
        "reference": "Patient/avery-linwood",
        "display": "Avery Linwood"
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "1",
        "display": "Person"
      }
    },
    {
      "what": {
        "reference": "Consent/nexus-privacy-directive-lockbox-whole-record",
        "display": "Whole-record disclosure restriction, 12 June 2026"
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "2",
        "display": "System Object"
      },
      "detail": [
        {
          "type": "overriddenDirective",
          "valueString": "avery-linwood-2026-06-12-01"
        }
      ]
    }
  ]
}