Support for well-formed AuditEvent records

[JohnMoehrke]

User story
I would like to see if Microsoft could implement audit logging using the AuditEvent profiling in the newly published IHE Implementation Guide -- https://profiles.ihe.net/ITI/BALP/index.html

It would be nice to have a reference implementation that customers could enable. It would likely not be something that would be on-by-default.

Acceptance criteria
Ability to configure the FHIR-Server to produce conformant AuditEvent resources

[mikaelweave]

Hi @JohnMoehrke, congrats on the IG publishing! I saw this on FHIR chat a month or so ago and was interested in how this could be done in our FHIR server. We tend to wait on new IGs and see if they will be pulled into regulatory requirements or widely adopted (by users or other IGs) as we have a deep backlog. 🤣

Do you have any details on when this will go normative or it's traction in the community? This information will help us prioritize. In the meantime, we assign the "Up for grabs" label to signal this is up for community contribution.

[JohnMoehrke]

Hi @mikaelweave , I fully understand that position. I would not expect different. But I do, as representative to IHE, need to try to encourage it.

ONC has the opposite problem, they want to see implementations before they commit something to regulation. That said, I have been working with them on a contract with IHE-USA and this Basic Audit IG was part of that ask. So, I have some confidence that they understand the need.

I think the most compelling need, that which will drive a demand in the market, is the support for providing an API to Patients that give the Patient a signal of how their data are used. Starting with the most specific AuditEvent profile in the IG, that is explicitly a Disclosure. This would be used when an activity that is the legal definition of a HIPAA Disclosure happens (These are almost non-existent due to the looseness of the HIPAA Disclosure definition). Following this would be the RESTful audits for all activity involving that Patients data.

The SAML and OAuth profiles are being driven in by some countries in Europe. The drive there is federated access to data, and investigations by the Patient, state, or custodian. So part of their cross boarder health network exchange, and within a country with regional controls.

So, I don't have a compelling regulator driving urgent need. I mostly want to get some implementations of it to prove that it is not flawed.

On the normative nature, well that requires that there are implementations of it. Governance rules require at-least three independently developed implementations. There are other factors too.

[mikaelweave]

Thanks for taking the time to explain this to me @JohnMoehrke! Really appreciate it as I'm newer in the FHIR space. I'll start asking about the need for patients to have access to what has been done during my FHIR conversations, especially when consent is involved. I think this may be the logical next step for patients who have consented for their data to be used unanonymized for secondary use.