AuditEvent Profile

Canonical	../StructureDefinition/nexus-emr-core-auditevent
Status	draft (experimental) · 1.26.0
Base	AuditEvent (constraint)
Source	FSH · JSON

Nexus EMR profile for AuditEvent -- the access and activity log: who acted, on which record, when, through what interaction, and with what outcome.

Examples

Audit avery break glass 20260903 · Chart Read Audit Entry · Packet Disclosure Audit Entry

Chart Read Audit Entry

A clinician reading a patient chart through the FHIR API -- the ordinary case. Carries agent.who as well as agent.altId, since this actor does resolve to a Practitioner, and shows action = R for a read

AuditEvent/audit-avery-chart-read-20250408 — claims conformance to AuditEvent Profile

{
  "resourceType": "AuditEvent",
  "id": "audit-avery-chart-read-20250408",
  "meta": {
    "profile": [
      "../StructureDefinition/nexus-emr-core-auditevent"
    ]
  },
  "text": {
    "status": "generated",
    "div": "<div xmlns='http://www.w3.org/1999/xhtml'><p>One record disclosure: Dr. Emil Navarro opened Avery Linwood's chart and the Patient record was returned to him. This is the entry a privacy report over access to personal health information is built from -- who, when, which record, and whether it succeeded.</p><p><strong>The actor is named twice, and both matter.</strong> <code>agent.altId</code> carries the identity-provider subject, which is the identity the platform actually holds on every entry and the value to match on when correlating against the <code>meta-updated-by</code> extension on a resource version. <code>agent.who</code> carries the resolved Practitioner, which a producer writes only when it can resolve the account to a person. <code>agent.name</code> is the username and is for display only.</p><p><strong>action is R, and R does not mean a single GET.</strong> Every interaction that is not a create, an update or a delete is recorded as a read -- a search that returned this record produces this same entry. Read it as "the record was disclosed to someone".</p><p><strong>recorded is the moment the entry was persisted</strong>, not the instant of the interaction; the two differ by however long the entry took to reach the log. <code>source.observer</code> names the endpoint reporting the entry, not the service where the interaction happened -- the log does not record which service produced an entry.</p></div>"
  },
  "type": {
    "system": "http://terminology.hl7.org/CodeSystem/audit-event-type",
    "code": "rest",
    "display": "RESTful Operation"
  },
  "subtype": [
    {
      "system": "http://hl7.org/fhir/restful-interaction",
      "code": "read",
      "display": "read"
    }
  ],
  "action": "R",
  "recorded": "2025-04-08T09:41:07-06:00",
  "outcome": "0",
  "agent": [
    {
      "who": {
        "reference": "Practitioner/dr-emil-navarro",
        "display": "Dr. Emil Navarro"
      },
      "altId": "auth0|6612f0c9a4de71b2c3d40915",
      "name": "enavarro",
      "requestor": true
    }
  ],
  "source": {
    "observer": {
      "reference": "Device/cedarbrook-juno-emr",
      "display": "Cedarbrook EMR FHIR API"
    }
  },
  "entity": [
    {
      "what": {
        "reference": "Patient/avery-linwood",
        "display": "Avery Linwood"
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "1",
        "display": "Person"
      }
    },
    {
      "what": {
        "reference": "Encounter/enc-avery-20250408-01rc",
        "display": "Annual wellness visit, 2025-04-08"
      },
      "type": {
        "system": "http://terminology.hl7.org/CodeSystem/audit-entity-type",
        "code": "2",
        "display": "System Object"
      }
    }
  ]
}