14 Security Granularity 2 - System Object
Definition
15 Provider 1 - Person
3 - Organization
16 Data Destination 2 - System Object
17 Data Repository 2 - System Object
18 Schedule 2 - System Object
19 Customer 3 - Organization
20 Job 2 - System Object
21 Job Stream 2 - System Object
22 Table 2 - System Object
23 Routing Criteria 2 - System Object
24 Query 2 - System Object
A "Security Resource" is an abstract securable object, e.g., a
screen, interface, document, program, etc. -- or even an audit
data set or repository.
Rationale
For some detailed audit analysis it may be necessary to indicate a
more granular type of participant, based on the application role
it serves.
5.5.3. Participant Object Data Life Cycle
Description
Identifier for the data life-cycle stage for the participant
object. This can be used to provide an audit trail for data, over
time, as it passes through the system.
Optionality: Optional
Format/Values
Enumeration:
Value Meaning
----- --------------------------------------
1 Origination / Creation
2 Import / Copy from original
3 Amendment
4 Verification
5 Translation
6 Access / Use
7 De-identification
8 Aggregation, summarization, derivation
9 Report
10 Export / Copy to target
11 Disclosure
12 Receipt of disclosure
13 Archiving
14 Logical deletion
15 Permanent erasure / Physical destruction
Rationale
Institutional policies for privacy and security may optionally
fall under different accountability rules based on data life
cycle. This provides a differentiating value for those cases.
5.5.4. Participant Object ID Type Code
Description
Describes the identifier that is contained in Participant Object
ID.
Optionality: Required
Format / Values
Coded-value enumeration, specific to Participant Object Type Code,
using attribute-name "code". The codes below are the default set.
Value Meaning Participant Object Type Codes
----- ---------------------- -----------------------------
1 Medical Record Number 1 - Person
2 Patient Number 1 - Person
3 Encounter Number 1 - Person
4 Enrollee Number 1 - Person
5 Social Security Number 1 - Person
6 Account Number 1 - Person
3 - Organization
7 Guarantor Number 1 - Person
3 - Organization
8 Report Name 2 - System Object
9 Report Number 2 - System Object
10 Search Criteria 2 - System Object
11 User Identifier 1 - Person
2 - System Object
12 URI 2 - System Object
User Identifier and URI [RFC2396] text strings are intended to be
used for security administration trigger events to identify the
objects being acted-upon.
The codes may be the default set stated above, implementation-
defined, or reference a standard vocabulary enumeration, such as
HL7 version 2.4 table 207 or DICOM defined media types. For
implementation defined codes or references to standards, the XML
schema defines these optional attributes:
Attribute Value
-------------- --------------------------------------------
CodeSystem OID reference
CodeSystemName Name of the coding system; strongly recommended
to be valued for locally-defined code-sets.
DisplayName The value to be used in displays and reports
OriginalText Input value that was translated to the code
Rationale
Required to distinguish among various identifiers that may
synonymously identify a participant object.
5.5.5. Participant Object Sensitivity
Description
Denotes policy-defined sensitivity for the Participant Object ID
such as VIP, HIV status, mental health status, or similar topics.
Optionality: Optional
Format / Values
Values are institution- and implementation-defined text strings.
5.5.6. Participant Object ID
Description
Identifies a specific instance of the participant object.
Optionality: Required
Format / Values
Text string. Value format depends on Participant Object Type Code
and the Participant Object ID Type Code.
Rationale
This field identifies a specific instance of an object, such as a
patient, to detect/track privacy and security issues.
Notes
Consider this to be the primary unique identifier key for the
object, so it may be a composite data field as implemented.
5.5.7. Participant Object Name
Description
An instance-specific descriptor of the Participant Object ID
audited, such as a person’s name.
Optionality: Optional
Format / Values
Text string
Rationale
This field may be used in a query/report to identify audit events
for a specific person, e.g., where multiple synonymous Participant
Object IDs (patient number, medical record number, encounter
number, etc.) have been used.
5.5.8. Participant Object Query
Description
The actual query for a query-type participant object.
Optionality: Optional
Format / Values
Base 64 encoded data
Rationale
For query events it may be necessary to capture the actual query
input to the query process in order to identify the specific
event. Because of differences among query implementations and
data encoding for them, this is a base 64 encoded data blob. It
may be subsequently decoded or interpreted by downstream audit
analysis processing.
5.5.9. Participant Object Detail
Description
Implementation-defined data about specific details of the object
accessed or used.
Optionality: Optional
Format
Type-value pair. The "type" attribute is an implementation-
defined text string. The "value" attribute is a base 64 encoded
data.
Rationale
Specific details or values from the object accessed may be desired
in specific auditing implementations. The type-value pair enables
the use of implementation-defined and locally-extensible object
type identifiers and values. For example, a clinical diagnostic
object may contain multiple test results, and this element could
document the type and number and type of results.
Many possible data encodings are possible for this elements, so
the value is a base 64 encoded data blob. It may be subsequently
decoded or interpreted by downstream audit analysis processing.
6. XML Schema
This section contains the actual XML schema definition for the data
defined in section 5. It also provides brief guidance for specifying
schema localizations for implementation purposes.
The XML schema specified in section 6.1 conforms with the W3C
Recommendations for XML Schema structure [W3CXML-1] and data types
[W3CXML-2].
6.1. XML Schema Definition
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
elementFormDefault="qualified" attributeFormDefault="unqualified">
<xs:element name="AuditMessage">
<xs:complexType>
<xs:sequence>
<xs:element name="EventIdentification"
type="EventIdentificationType"/>
<xs:element name="ActiveParticipant" maxOccurs="unbounded">
<xs:complexType>
<xs:complexContent>
<xs:extension base="ActiveParticipantType"/>
</xs:complexContent>
</xs:complexType>
</xs:element>
<xs:element name="AuditSourceIdentification"
type="AuditSourceIdentificationType" maxOccurs="unbounded"/>
<xs:element name="ParticipantObjectIdentification"
type="ParticipantObjectIdentificationType" minOccurs="0"
maxOccurs="unbounded"/>
</xs:sequence>
</xs:complexType>
</xs:element>
<xs:complexType name="EventIdentificationType">
<xs:sequence>
<xs:element name="EventID" type="CodedValueType"/>
<xs:element name="EventTypeCode" type="CodedValueType"
minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="EventActionCode" use="optional">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="C">
<xs:annotation>
<xs:appinfo>Create</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="R">
<xs:annotation>
<xs:appinfo>Read</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="U">
<xs:annotation>
<xs:appinfo>Update</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="D">
<xs:annotation>
<xs:appinfo>Delete</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="E">
<xs:annotation>
<xs:documentation>Execute</xs:documentation>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="EventDateTime" type="xs:dateTime"
use="required"/>
<xs:attribute name="EventOutcomeIndicator" use="required">
<xs:simpleType>
<xs:restriction base="xs:integer">
<xs:enumeration value="0">
<xs:annotation>
<xs:appinfo>Success</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="4">
<xs:annotation>
<xs:appinfo>Minor failure</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="8">
<xs:annotation>
<xs:appinfo>Serious failure</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="12">
<xs:annotation>
<xs:appinfo>Major failure; action made unavailable
</xs:appinfo>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
<xs:complexType name="AuditSourceIdentificationType">
<xs:sequence>
<xs:element name="AuditSourceTypeCode" minOccurs="0"
maxOccurs="unbounded">
<xs:complexType>
<xs:complexContent>
<xs:restriction base="CodedValueType">
<xs:attribute name="code" use="required">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="1">
<xs:annotation>
<xs:appinfo>End-user display device, diagnostic
display</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="2">
<xs:annotation>
<xs:appinfo>Data acquisition device or
instrument</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3">
<xs:annotation>
<xs:appinfo>Web server process</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="4">
<xs:annotation>
<xs:appinfo>Application server process</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="5">
<xs:annotation>
<xs:appinfo>Database server process</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="6">
<xs:annotation>
<xs:appinfo>Security server, e.g., a domain
controller</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="7">
<xs:annotation>
<xs:documentation>ISO level 1-3 network
component</xs:documentation>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="8">
<xs:annotation>
<xs:appinfo>ISO level 4-6 operating software</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="9">
<xs:annotation>
<xs:appinfo>External source, other or unknown
type</xs:appinfo>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
</xs:element>
</xs:sequence>
<xs:attribute name="AuditEnterpriseSiteID" type="xs:string"
use="optional"/>
<xs:attribute name="AuditSourceID" type="xs:string"
use="required"/>
</xs:complexType>
<xs:complexType name="ActiveParticipantType">
<xs:sequence minOccurs="0">
<xs:element name="RoleIDCode" type="CodedValueType" minOccurs="0"
maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="UserID" type="xs:string" use="required"/>
<xs:attribute name="AlternativeUserID" type="xs:string"
use="optional"/>
<xs:attribute name="UserName" type="xs:string" use="optional"/>
<xs:attribute name="UserIsRequestor" type="xs:boolean"
use="optional" default="true"/>
<xs:attribute name="NetworkAccessPointID" type="xs:string"
use="optional"/>
<xs:attribute name="NetworkAccessPointTypeCode" use="optional">
<xs:simpleType>
<xs:restriction base="xs:unsignedByte">
<xs:enumeration value="1">
<xs:annotation>
<xs:appinfo>Machine Name, including DNS name</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="2">
<xs:annotation>
<xs:appinfo>IP Address</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3">
<xs:annotation>
<xs:appinfo>Telephone Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:complexType>
<xs:complexType name="ParticipantObjectIdentificationType">
<xs:sequence>
<xs:element name="ParticipantObjectIDTypeCode">
<xs:complexType>
<xs:complexContent>
<xs:restriction base="CodedValueType">
<xs:attribute name="code" use="required">
<xs:simpleType>
<xs:restriction base="xs:string">
<xs:enumeration value="1">
<xs:annotation>
<xs:appinfo>Medical Record Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="2">
<xs:annotation>
<xs:appinfo>Patient Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3">
<xs:annotation>
<xs:appinfo>Encounter Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="4">
<xs:annotation>
<xs:appinfo>Enrollee Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="5">
<xs:annotation>
<xs:appinfo>Social Security Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="6">
<xs:annotation>
<xs:appinfo>Account Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="7">
<xs:annotation>
<xs:appinfo>Guarantor Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="8">
<xs:annotation>
<xs:appinfo>Report Name</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="9">
<xs:annotation>
<xs:appinfo>Report Number</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="10">
<xs:annotation>
<xs:appinfo>Search Criteria</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="11">
<xs:annotation>
<xs:appinfo>User Identifier</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="12">
<xs:annotation>
<xs:appinfo>URI</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value=""/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:restriction>
</xs:complexContent>
</xs:complexType>
</xs:element>
<xs:choice minOccurs="0">
<xs:element name="ParticipantObjectName" type="xs:string"
minOccurs="0"/>
<xs:element name="ParticipantObjectQuery" type="xs:base64Binary"
minOccurs="0"/>
</xs:choice>
<xs:element name="ParticipantObjectDetail"
type="TypeValuePairType" minOccurs="0" maxOccurs="unbounded"/>
</xs:sequence>
<xs:attribute name="ParticipantObjectID" type="xs:string"
use="required"/>
<xs:attribute name="ParticipantObjectTypeCode" use="optional">
<xs:simpleType>
<xs:restriction base="xs:unsignedByte">
<xs:enumeration value="1">
<xs:annotation>
<xs:appinfo>Person</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="2">
<xs:annotation>
<xs:appinfo>System object</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3">
<xs:annotation>
<xs:appinfo>Organization</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="4">
<xs:annotation>
<xs:appinfo>Other</xs:appinfo>
</xs:annotation>
</xs:enumeration>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="ParticipantObjectTypeCodeRole" use="optional">
<xs:simpleType>
<xs:restriction base="xs:unsignedByte">
<xs:enumeration value="1">
<xs:annotation>
<xs:appinfo>Patient</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="2">
<xs:annotation>
<xs:appinfo>Location</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="3">
<xs:annotation>
<xs:appinfo> Report</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="4">
<xs:annotation>
<xs:appinfo>Resource</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="5">
<xs:annotation>
<xs:appinfo>Master file</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="6">
<xs:annotation>
<xs:appinfo>User</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="7">
<xs:annotation>
<xs:appinfo>List</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="8">
<xs:annotation>
<xs:appinfo>Doctor</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="9">
<xs:annotation>
<xs:appinfo>Subscriber</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="10">
<xs:annotation>
<xs:appinfo>Guarantor</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="11">
<xs:annotation>
<xs:appinfo>Security User Entity</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="12">
<xs:annotation>
<xs:appinfo>Security User Group</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="13">
<xs:annotation>
<xs:appinfo>Security Resource</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="14">
<xs:annotation>
<xs:appinfo>Security Granualarity Definition</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="15">
<xs:annotation>
<xs:appinfo>Provider</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="16">
<xs:annotation>
<xs:appinfo>Report Destination</xs:appinfo>
</xs:annotation>
</xs:enumeration>
<xs:enumeration value="17">
<xs:annotation>
<xs:appinfo>Report Library</xs:appinfo>
</xs:annotation>
</xs:enumeration>