Stream: ihe
Topic: ATNA on FHIR
Simone Heckmann (Nov 27 2017 at 10:27):
For applications implementing MHD or other FHIR based Profiles, I think it would make sense to implement ATNA using the AuditEvent Resource. However, I can't seem to find any reference to FHIR as an option for implementing ITI-20 (record Audit Event), only for ITI-81 (retrieve Audit Event). Can anyone help me out?
John Moehrke (Nov 27 2017 at 13:40):
Hi Simone. The ITI committee has had too many work items to work on, so this one continues to fall off. A strong reason for us to not find priority to documenting it is that it seems very obvious to us what a predominant FHIR based application would use to record an AuditEvent. Thus we figure that the audience that needs to hear about a FHIR based method of recording an AuditEvent using http POST is likely to already have figured it out without us having a dedicated profile/option/transaction for it. Right?
Simone Heckmann (Nov 27 2017 at 13:55):
Right. I was just a bit confused as it seems that you're allowed to query on AuditEvens but not recording AuditEvents on FHIR :)
Grahame Grieve (Nov 27 2017 at 22:36):
what are you not allowed to do?
Simone Heckmann (Nov 30 2017 at 12:15):
Implement ATNA using FHIR/AuditEvent and claim conformance to ATNA.
Grahame Grieve (Nov 30 2017 at 12:37):
oh right, no, you can't claim conformance - yet. But I think IHE will probably go there in time
John Moehrke (Nov 30 2017 at 15:14):
we keep trying.. but more important (useful) work items keep bumping it off the list... need the community to express just how important this is to them.
Simone Heckmann (Dec 01 2017 at 10:28):
I think the fact that you can implement the whole stack of dependent profiles (MHD, PIXm, PDQm and ATNAm) using just one standard is a big selling point for the FHIR-based profiles vs. the "traditional" ones.
John Moehrke (Dec 01 2017 at 14:12):
I would be compelled more if I had any belief that Apps wanted to log audit events.... They tend to not want to log audit events, leaving all that kind of Accountability responsibility to the server. Those that do want to record an audit event are likely to figure it out quickly. This is the rational as to why IHE has not taken this on as a priority. I would welcome someone taking this on as a Change Proposal, however the likely historic authors are not available.
Simone Heckmann (Dec 02 2017 at 17:38):
But all of the above mentioned Profiles also define Actors that would be FHIR servers and would be required to log AuditEvents...
Mario Hyland (Aug 28 2018 at 19:51):
@John Moehrke is this still getting bumped off the list?
John Moehrke (Aug 28 2018 at 19:59):
Now is the time to propose new work items for IHE https://healthcaresecprivacy.blogspot.com/2018/08/open-call-for-ihe-work-item-proposals.html
Simone Heckmann (Sep 02 2018 at 15:33):
+1 for ATNA on FHIR
John Moehrke (Sep 03 2018 at 17:16):
So what is the use-case you have in mind for ATNA on FHIR? There is already quite a bit of FHIR support in ATNA.
John Moehrke (Sep 03 2018 at 17:35):
IHE can't host the ValueSet and CodeSystem on their web site. I am working on this and making progress. Until then they are stuck with a FTP site. I have resisted using FTP URLs...
Simone Heckmann (Sep 04 2018 at 13:31):
concerning ATNA UseCases: see our discussion in this thread from november/december '17:
FHIR based server implementations that are required to write an audit trail can't use the AuditEvent resource and claim ATNA conformance, or has this changed in the meantime?
John Moehrke (Sep 04 2018 at 13:39):
So, simply the use-case of write using FHIR AuditEvent, not just syslog... okay. Please help rally interest in this. It has been proposed for two years and no one votes for it.
Simone Heckmann (Sep 04 2018 at 13:50):
How do I vote for it? (Assuming the proposal has already been submitted)
John Moehrke (Sep 04 2018 at 13:54):
That is done in the IHE ITI Planning meeting October 10-11. Membership is required to vote. https://www.ihe.net/participate/ Anyone can call into the call and express verbal support.
Simone Heckmann (Sep 04 2018 at 13:59):
Does affiliate membership count?
John Moehrke (Sep 04 2018 at 14:13):
yes there are some regional members. https://www.ihe.net/about_ihe/member_organizations/
Last updated: Apr 12 2022 at 19:14 UTC
