Audit

The IHE ATNA audit trail: [audit] and its three sinks. Precedence, the environment-name grammar, and file discovery are on the Configuration reference index.

• [audit]
  • [audit.store]: the local Audit Record Repository
  • [audit.categories]
  • [audit.syslog]: the classic DICOM/syslog feed (ITI-20)
  • [audit.fhir_feed]: the RESTful-ATNA feed (ITI-20 ATX:FHIR Feed)

[audit]

The IHE ATNA audit trail (see the Audit trail chapter for what a record contains and how to search it). On by default with only the local store active: every deployment gets a queryable audit trail with nothing leaving the node, and forwarding to an external Audit Record Repository is opt-in per sink.

[audit]
enabled = true
source_id = "ferroehr"
value_if_missing = "UNKNOWN"
suppress_login_events = true
fail_mode = "open"
resolve_subject = true
queue_capacity = 8192
purpose_header = "x-purpose-of-use"
purpose_codes = []
emergency_purpose_codes = []

Note

The local store and the ATX:FHIR Feed both carry a FHIR R4 AuditEvent document, so both need the fhir build feature, on in the published binary and container images. A binary built with --no-default-features refuses at startup if audit.store.enabled or audit.fhir_feed.enabled is set; the DICOM/syslog feed needs no FHIR and stays available.

Note

There is no [atna] section. Configuration is strict, so a file or environment variable still setting an [atna] key fails at boot with an unknown-key error; move the setting under [audit].

[audit.store]: the local Audit Record Repository

The local store is the durability anchor of the whole subsystem: with it on, the FHIR feed drains from it, so a down repository loses nothing.

The floors and ceilings are written in calendar years. In every EU Member State the floor is three years (EHDS Art. 9(2)), and a longer national floor wins: five years in the Netherlands. Switzerland keeps its one-year floor. A retention_years value is compared against them exactly. A retention_days value is held to the most days the years can span for a floor (1096 for three years, 1830 for the Dutch five, 366 for one) and to the fewest for a ceiling (1095 for the German three). A declared § 309 controller in Germany therefore has no retention_days value that passes both the EHDS floor and the § 309 ceiling, and sets retention_years = 3:

[audit.store]
retention_years = 3
sgb_v_309_controller = true

[audit.categories]

The map every access record is classified through by EHDS priority category (Annex II 3.2(c); see the EHDS logging elements). A template id, or failing that a root archetype id, maps to a list of categories. Empty by default: FerroEHR ships no map, and an access the map cannot classify is recorded unclassified with its ids, never refused.

[audit.categories.templates]
"International Patient Summary" = ["patient-summary"]
"Laboratory Report" = ["test-results"]

[audit.categories.archetypes]
"openEHR-EHR-COMPOSITION.report-result.v1" = ["test-results"]
"openEHR-EHR-COMPOSITION.encounter.v1" = ["none"]

The categories are patient-summary, eprescription, edispensation, imaging, test-results and discharge-report (EHDS Art. 14(1)), a national additional category as national:<code>, and none for content that holds no priority-category data. Keys compare case-insensitively. An unknown spelling, an empty list, none combined with a category, or two keys that differ only in case refuses boot with a message naming the entry.

The map’s SHA-256 digest is on the boot line, on GET /management/info under audit.category_map, and on every access record. At boot the map is also mirrored into the retention register, so a retention period can be keyed on a category through the admin marks API.

[audit.syslog]: the classic DICOM/syslog feed (ITI-20)

[audit.fhir_feed]: the RESTful-ATNA feed (ITI-20 ATX:FHIR Feed)

With the local store on, the feed drains the store’s outbox and is therefore loss-free across a repository outage. With the store off it ships in-drain, and a record that exhausts its retries is dropped and counted.