A record of an interaction with the estate: the actor, the moment, the interaction performed, its
outcome, and the records it concerned.
Audit entries are append-only by intent. An entry describes something that happened; correcting it
by rewriting it destroys the property that makes it worth keeping. Where an entry is wrong, record
a further entry.
The metadata about the resource. This is content that is maintained by the infrastructure. Changes to the content might not always be associated with version changes to the resource.
A set of rules under which this content was created
Definition
A reference to a set of rules that were followed when the resource was constructed, and which must be understood when processing the content. Often, this is a reference to an implementation guide that defines the special rules along with other profiles etc.
Comments
Asserting this rule set restricts the content to be only understood by a limited set of trading partners. This inherently limits the usefulness of the data in the long term. However, the existing health eco-system is highly fractured, and not yet ready to define, collect, and exchange data in a generally computable sense. Wherever possible, implementers and/or specification writers should avoid using this element. Often, when used, the URL is a reference to an implementation guide that defines these special rules as part of it's narrative along with other profiles, value sets, etc.
Cardinality
0..1
Type
uri
Modifier
yes — This element is labeled as a modifier because the implicit rules may provide additional knowledge about the resource that modifies it's meaning or interpretation
The base language in which the resource is written.
Comments
Language is provided to support indexing and accessibility (typically, services such as text to speech use the language tag). The html language tag in the narrative applies to the narrative. The language tag on the resource may be used to specify the language of other presentations generated from the data in the resource. Not all the content has to be in the base language. The Resource.language should not be assumed to apply to the narrative automatically. If a language is specified, it should it also be specified on the div element in the html (see rules in HTML5 for information about the relationship between xml:lang and the html lang attribute).
A human-readable narrative summary of the NexusEmrCoreAuditEvent resource for human interpretation.
Comments
Contained resources do not have narrative. Resources that are not contained SHOULD have a narrative. In some cases, a resource may only have text with little or no additional discrete data (as long as all minOccurs=1 elements are satisfied). This may be necessary for data from legacy systems where information is captured as a "text blob" or where text is additionally entered raw or narrated and encoded information is added later.
These resources do not have an independent existence apart from the resource that contains them - they cannot be identified independently, and nor can they have their own independent transaction scope.
Comments
This should never be done when the content can be identified properly, as once identification is lost, it is extremely difficult (and context dependent) to restore it again. Contained resources may have profiles and tags In their meta elements, but SHALL NOT have security labels.
May be used to represent additional information that is not part of the basic definition of the resource. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
May be used to represent additional information that is not part of the basic definition of the resource and that modifies the understanding of the element that contains it and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer is allowed to define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the resource that contains them
Identifier for a family of the event. For example, a menu item, program, rule, policy, function code, application name or URL. It identifies the performed function.
Requirements
This identifies the performed function. For "Execute" Event Action Code audit records, this identifies the application function performed.
Comments
Required by R4 (1..1) and NOT yet fixed by this guide, though two values are recommended and both
come from the standard vocabulary rather than from a local one.
http://terminology.hl7.org/CodeSystem/audit-event-type#rest for an entry describing a FHIR API
interaction, which is what a projection of the platform's access log writes for the great majority of
entries. http://dicom.nema.org/resources/ontology/DCM#110106 (Export) for an entry describing
information LEAVING the estate -- a packet released, a report downloaded, a referral transmitted --
because action cannot express that distinction and a disclosure report has to be able to find those
entries. Recommended rather than required: nothing writes an AuditEvent through this API today, so
fixing a value would constrain a producer that does not exist. Do not invent a local vocabulary here.
The narrower activity, where the event is not simply a REST interaction
Definition
Identifier for the category of event.
Requirements
This field enables queries of messages by implementation-defined event categories.
Comments
Where an entry describes a named platform activity rather than an interaction with a chart record --
assembling a document packet, launching a billing handoff, running an eligibility check, exchanging
credentials, transmitting a referral -- the activity belongs here rather than on entity.
NO VOCABULARY IS PUBLISHED FOR THAT SET. The platform's log carries its own activity names, and this
guide does not yet declare a code system for them: the majority of the values name FHIR resource
types, which already have a published code system, and minting a second one that restates them would
be a permanent commitment to a duplicate. What would settle it is the residue -- the values that name
a platform activity rather than a resource type -- published as a code system in its own right.
Until then, read subtype liberally and do not assume a system URI.
Indicator for type of action performed during the event that generated the audit.
Requirements
This broadly indicates what kind of action was done on the AuditEvent.entity by the AuditEvent.agent.
Comments
R4 binds this to five codes (C, R, U, D, E) and this guide adds none.
TWO THINGS A READER MUST KNOW. First, every interaction that is not a create, an update or a delete
is recorded as a READ -- searches, version reads and history reads included. R therefore means
"the record was disclosed to someone", which is what a privacy report wants, and does not mean a
single-resource GET. A search that returned twelve records yields TWELVE read entries, one per
record returned, rather than one entry for the search: the question an access log has to answer is
which records were disclosed, not how many queries were run. Count records, not entries, and expect
a busy chart view to produce many.
Second, the platform distinguishes a TRANSMISSION -- a referral sent to an external party, a report
exported or downloaded -- from an ordinary read, and R4's five codes do not express that distinction.
Until it is settled, a transmission projected here appears as R, and the fact that it left the
estate is carried on type/subtype rather than on action. A consumer answering "what was
disclosed outside the clinic" must therefore not read action alone. Settling it means either
assigning the standard export event type on type as a required convention, or an extension; this
guide has done neither yet.
Preferred over recorded as THE moment where it is present, for the reason above. The platform's access log does not populate it today, so it is optional and its absence is expected rather than a defect.
This ties an event to a specific date and time. Security audits typically require a consistent time base (e.g. UTC), to eliminate time-zone issues arising from geographical distribution.
Comments
R4 makes this 1..1, and it is the one element every entry carries. It is the moment the entry was PERSISTED, which is not exactly the moment of the interaction: entries reach the log asynchronously and the stamp is applied on arrival. The difference is small and it is not zero. Order interactions by it freely; reconcile it against an external timestamp with care, and prefer period where an entry carries one.
The platform records three outcomes -- succeeded, failed, and could not be determined -- against
R4's four severity-graded codes. The mapping this guide states: a success is 0; a failure is 4
(minor failure), because the platform does not grade failures and claiming a serious or major
failure would assert something it did not observe; an undetermined outcome carries NO code.
READ AN ABSENT outcome AS UNKNOWN, NEVER AS SUCCESS. It is the single most consequential misread
available on this resource: an access whose outcome could not be determined is exactly the access a
privacy review wants surfaced, and defaulting it to success buries it.
ONE CLASS OF ENTRY CARRIES A SUCCESS OUTCOME THAT IS NOT A CLAIM ABOUT THE RESULT. An entry recorded
for an INVOKED OPERATION is written when the invocation is accepted, before the operation has
resolved, and records that the attempt was made. Its outcome is not evidence that the operation
succeeded. Entries for record interactions are written on the response and their outcome does reflect
it.
A free text description of the outcome of the event.
Comments
The platform's log carries an optional free-text detail on any entry, not only on a failure. R4 scopes this element to describing the outcome, which is narrower than what is written; a consumer should treat the text as descriptive of the event and should not assume it is present only on failures, nor that it is machine-readable.
The reason the interaction occurred, bound extensibly by R4 to the standard purpose-of-use
vocabulary (treatment, payment, operations, emergency treatment, and the rest).
This guide does not yet constrain it, and emergency access is the reason to say so explicitly.
Where a clinician overrides a patient's restriction on their record to obtain information in an
emergency, this element -- together with agent.purposeOfUse and agent.policy -- is where base R4
records that the access was an override and under what authority. That is the shape a reader should
expect if and when such a record appears.
No such record is produced in this estate today. Nothing implements an emergency-access
override, and this guide therefore constrains nothing about one: no code is fixed, no element is
made mandatory, and no invariant asserts that an override carries a justification. Read the absence
of purposeOfEvent on an entry as "not recorded", not as "routine access".
What would settle it: the override itself becoming a product behaviour, at which point the question
this guide has to answer is whether the override is a coded purpose on the access entry, as here, or
a separate record of its own with the access entry pointing at it. The two differ in whether the
justification is queryable independently of the access it authorised.
Comments
Use AuditEvent.agent.purposeOfUse when you know that it is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
The actor or actors involved in the interaction. R4 makes this 1..*.
The platform's access log records exactly ONE actor per entry: the identity that made the request.
Entries carrying a second agent -- a recipient of a disclosure, a system acting on a user's behalf --
are permitted by R4 and are not produced today.
Requirements
An agent can be a person, an organization, software, device, or other actors that may be ascribed responsibility.
Comments
Several agents may be associated (i.e. have some responsibility for an activity) with an event or activity.
For example, an activity may be initiated by one user for other users or involve more than one user. However, only one user may be the initiator/requestor for the activity.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
The security role that the user was acting under, that come from local codes defined by the access control security system (e.g. RBAC, ABAC) used in the local context.
Requirements
This value ties an audited event to a user's role(s). It is an optional value that might be used to group events for analysis by user functional role categories.
Comments
Should be roles relevant to the event. Should not be an exhaustive list of roles.
Reference to who this agent is that was involved in the event.
Requirements
This field ties an audit event to a specific resource or identifier.
Comments
Left OPTIONAL deliberately. The identity the platform holds for an actor is an identity-provider subject, not a resource reference, and resolving it needs an identity directory this guide does not describe; not every actor has a Practitioner resource at all. Where a producer CAN resolve the actor it should write both this and altId. Per the Nexus EMR logical-reference model the reference MAY be identifier-only.
The opaque account identifier the identity provider issues for the acting user (for example
auth0|abc123). This is the identity the platform actually holds on every entry, and it is the
element to match on when correlating an audit entry with the meta-updated-by extension on a
resource version -- the two carry the same kind of value for the same reason.
NOT a FHIR id and NOT a Practitioner reference. Resolving it to a person needs the identity
directory, which this guide does not describe.
Requirements
In some situations, a human user may authenticate with one identity but, to access a specific application system, may use a synonymous identify. For example, some "single sign on" implementations will do this. The alternative identifier would then be the original identify used for authentication, and the User ID is the one known to and used by the application.
The User ID and Authorization User ID may be internal or otherwise obscure values. This field assists the auditor in identifying the actual user.
Comments
A display label -- the actor's username, falling back to their email address where no username is held. FOR DISPLAY ONLY. It is not stable, it is not unique, and it must never be used for an authorization or matching decision; altId is the identity.
Indicator that the user is or is not the requestor, or initiator, for the event being audited.
Requirements
This value is used to distinguish between requestor-users and recipient-users. For example, one person may initiate a report-output to be sent to another user.
Comments
R4 makes this 1..1. The single agent on a platform-produced entry is the requester, so true is the expected value; an entry naming a second, non-initiating agent sets it false on that agent.
The policy or plan that authorized the activity being recorded. Typically, a single activity may have multiple applicable policies, such as patient consent, guarantor funding, etc. The policy would also indicate the security token used.
Requirements
This value is used retrospectively to determine the authorization policies.
Comments
Where an interaction was authorised by something nameable -- a consent directive, a provincial consent-override transaction -- its identifier belongs here as a URI. Not produced today; named so that a producer of such a record has a declared element rather than an invented one.
Logical network location for application activity, if the activity has a network location.
Comments
NOT populated. The platform's access log does not record the requesting network address on ordinary entries, so a consumer must not expect one and must not treat its absence as evidence about the origin of a request. Constraining it would assert a guarantee that does not exist. What would settle it is the address being captured at the API tier; the element is named here so that it lands in the right place when it is.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
Identifier for the network access point of the user device
Definition
An identifier for the network access point of the user device for the audit event.
Requirements
This datum identifies the user's network access point, which may be distinct from the server that performed the action. It is an optional value that may be used to group events recorded on separate servers for analysis of a specific network access point's data access across all servers.
Comments
This could be a device id, IP address or some other identifier associated with a device.
An identifier for the type of network access point that originated the audit event.
Requirements
This datum identifies the type of network access point identifier of the user device for the audit event. It is an optional value that may be used to group events recorded on separate servers for analysis of access according to a network access point's type.
The reason (purpose of use), specific to this agent, that was used during the event being recorded.
Comments
Use AuditEvent.agent.purposeOfUse when you know that is specific to the agent, otherwise use AuditEvent.purposeOfEvent. For example, during a machine-to-machine transfer it might not be obvious to the audit system who caused the event, but it does know why.
R4 makes source 1..1 and source.observer 1..1, so any conformant instance must name an observer. The platform's access log does not record which service produced an entry: entries arrive from every service in the estate on one shared channel and carry no producer identity. A projection therefore has to supply the observer from the endpoint doing the projecting rather than read it from the entry. Treat source.observer as naming the reporting endpoint, not the service where the interaction occurred.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
Logical source location within the healthcare enterprise network. For example, a hospital or other provider location within a multi-entity provider group.
Requirements
This value differentiates among the sites in a multi-site enterprise health information system.
Comments
Not populated. The estate is multi-tenant and an entry is scoped to its tenant, but tenancy is carried out of band rather than on the resource, so this element does not receive it. A projection serving more than one tenant must scope its results rather than expecting a reader to filter on this.
Code specifying the type of source where event originated.
Requirements
This field indicates which type of source is identified by the Audit Source ID. It is an optional value that may be used to group events for analysis according to the type of source where the event occurred.
What the interaction was about. For an interaction with a chart record this is the record itself;
an entry may name more than one, and a single interaction that touched several records names each.
The platform's log carries the target of the interaction plus a set of correlation identifiers
gathered from the enclosing operation, so that the entries written for one transaction can be
retrieved together. Projected here, each of those is an entity.
COVERAGE IS THE WHOLE TYPE SPACE, not the set this guide profiles. Every R4 resource type reaching
the FHIR API is classified and logged, including types this specification does not model. A
consumer should not assume that the types appearing in an access log are the types described here.
Requirements
The event may have other entities involved.
Comments
Optional (0..*) because entries describing an activity rather than a record -- a credential exchange, a report run -- legitimately concern no resource.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
Identifies a specific instance of the entity. The reference should be version specific.
Comments
Per the Nexus EMR logical-reference model this MAY be identifier-only, and in a projection of the platform's log it usually IS: the log stores the target's identifier rather than a resolvable reference. A consumer treating a reference with no literal reference as absent will read most entries as concerning nothing. NOTE also that the log records a target identifier only where the record's id takes the platform's identifier form; entries for records whose id does not take that form are recorded WITHOUT a target, and the interaction is then reconstructable only from the entry's other elements.
The type of the object that was involved in this audit event.
Requirements
To describe the object being acted upon. In addition to queries on the subject of the action in an auditable event, it is also important to be able to query on the object type for the action.
Comments
Bound extensibly by R4 to a four-value vocabulary (person, system object, organization, other), which is coarser than the resource type a reader usually wants. Where entity.what is a typed reference the resource type is readable there and is the better answer; this element says only which of the four kinds it falls into.
Identifier for the data life-cycle stage for the entity.
Requirements
Institutional policies for privacy and security may optionally fall under different accountability rules based on data life cycle. This provides a differentiating value for those cases.
Comments
This can be used to provide an audit trail for data, over time, as it passes through the system.
Use only where entity can't be identified with an identifier.
Comments
This field may be used in a query/report to identify audit events for a specific person. For example, where multiple synonymous entity identifiers (patient number, medical record number, encounter number, etc.) have been used.
For query events, it may be necessary to capture the actual query input to the query process in order to identify the specific event. Because of differences among query implementations and data encoding for them, this is a base 64 encoded data blob. It may be subsequently decoded or interpreted by downstream audit analysis processing.
Comments
The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example, if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.
Named values carrying detail about the record concerned
Definition
Tagged value pairs for conveying additional information about the entity.
Requirements
Implementation-defined data about specific details of the object accessed or used.
Comments
Where an entry needs to carry a measured value about what it describes -- how many pages a disclosure withheld, which parameters a report ran with -- this is the element for it, as a named type with its value. No detail names are fixed by this guide, so a consumer must read the type string rather than assume a position.
May be used to represent additional information that is not part of the basic definition of the element. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Extensions that cannot be ignored even if unrecognized
Definition
May be used to represent additional information that is not part of the basic definition of the element and that modifies the understanding of the element in which it is contained and/or the understanding of the containing element's descendants. Usually modifier elements provide negation or qualification. To make the use of extensions safe and manageable, there is a strict set of governance applied to the definition and use of extensions. Though any implementer can define an extension, there is a set of requirements that SHALL be met as part of the definition of the extension. Applications processing a resource are required to check for modifier extensions.
Modifier extensions SHALL NOT change the meaning of any elements on Resource or DomainResource (including cannot change the meaning of modifierExtension itself).
Requirements
Modifier extensions allow for extensions that cannot be safely ignored to be clearly distinguished from the vast majority of extensions which can be safely ignored. This promotes interoperability by eliminating the need for implementers to prohibit the presence of extensions. For further information, see the definition of modifier extensions.
Comments
There can be no stigma associated with the use of extensions by any application, project, or standard - regardless of the institution or jurisdiction that uses or defines the extensions. The use of extensions is what allows the FHIR specification to retain a core level of simplicity for everyone.
Cardinality
0..*
Type
Extension
Modifier
yes — Modifier extensions are expected to modify the meaning or interpretation of the element that contains them
Should not duplicate the entity value unless absolutely necessary.
Comments
The value can be string when known to be a string, else base64 encoding should be used to protect binary or undefined content. The meaning and secondary-encoding of the content of base64 encoded blob is specific to the AuditEvent.type, AuditEvent.subtype, AuditEvent.entity.type, and AuditEvent.entity.role. The base64 is a general-use and safe container for event specific data blobs regardless of the encoding used by the transaction being recorded. An AuditEvent consuming application must understand the event it is consuming and the formats used by the event. For example if auditing an Oracle network database access, the Oracle formats must be understood as they will be simply encoded in the base64binary blob.