Audit Requirements Count

	A	B	C	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R
1	Item	ASTM	CCHIT	DoD	HL7	HALC	IEEE	IHE	MU1	MU2	NEMA	OB	PCI	SANS	NIST	HITSP	CHI

2	Access/View	1	1	2	1	1		4	1		1		1	1			1	15
3	Disperse/Deliver				1			2										3
4	Merge record				1													1
5	Unmerge record				1													1
6	User login	1	1	1	1	2	1				1	2	1	1				12
7	Modify log content				1		1	1			1							4
8	Modify user account				1		1	1			1						1	5
9	Delete user account				1		1				1							3
10	User logout	1	1	1	1						1			1				6
11	Session Timeout		1		1			1			1							4
12	Delete log content				1						1							2
13	Access log content				1			1					1					3
14	Disable audit				1			1		1								3
15	Enable audit				1			1		1								3
16	Grant access right				1									1				2
17	Revoke access right				1									1				2
18	Update classification configuration that affect protected information				1			1										2
19	Update function definition				1			1										2
20	Update role definition				1			1										2
21	Update security domain definition				1			1										2
22	Activate classification definition				1													1
23	Activate function definition				1													1
24	Activate role definition				1													1
25	Activate security domain definition				1													1
26	Activation of data definition				1													1
27	Create classification definition				1													1
28	Create function definition				1													1
29	Create permission definition				1													1
30	Create role definition				1													1
31	Create security domain definition				1													1
32	Deactivate classification definition				1													1
33	Deactivate function definition				1													1
34	Deactivate role definition				1													1
35	Deactivate security domain definition				1													1
36	Deactivation of data definition				1													1
37	Update data definition				1													1
38	Date & Time	1	1	1	1	1			1		1	1	1	1	1		1	12
39	User Identification	1	1	1	1	1			1		1	1	1		1		1	11
40	Role ID				1												1	2
41	Success/Failure		1		1	1						1	1	1	1			7
42	Destination ID				1	1									1			3
43	Object affected data lifecycle				1													1
44	Object affected ID type				1													1
45	Object affected type				1													1
46	Deassign				2													2
47	Create user account				2		1				1						1	5
48	Modify user privileges				2	1	1	1						1				6
49	Type of Event	1	1		2	1					1	1	1	1	1		1	11
50	Source	2		1	2	1					3	1	1	1	1			13
51	Object affected	1			2	1						1	1	1	1			8
52	Source Type				2													2
53	Assign				3			2										5
54	Resolve/complete			1	4			3										8
55	Create	1	2	1	5	1		7	1		1		1	1			1	22
56	Modify	1	1		5	1		8	1		1			1			1	20
57	Cancel				5			4										9
58	Delete	1	1	1		1		4	1		1	1	1	1			---	13
59	Startup		1	1		3	1	1			1	1		1				10
60	Shutdown		1	1		3	1	1			1			1				9
61	Security Administration Events (General/Other)		1	1		5	2				1	2	1	1				14
62	Export		1					1			1							3
63	Create log files										1		1					2
64	Detection of malicious activity										1			1				2
65	Emergency mode operation							1			1							2
66	Change system date/time										1							1
67	Change to network security configuration										1							1
68	De-identify PHI										1							1
69	Hardware modification										1							1
70	Re-association of data										1							1
71	Switching to another user's access after logging in with one'own identification										1							1
72	Update virus signatures										1							1
73	Print (or fax)	1									1							2
74	Faults/Errors			1		1					2			1				5
75	Node authentication failure		1					1			2							4
76	Closed network connection			1		1	1	1			3							7
77	Unauthorized access attempt			2		1	1	1					1					6
78	Initiate network connection					1	1	1						2				5
79	Access to cryptographic keys						1											1
80	Chage audit configuration						1											1
81	Change of access protocol/port						1											1
82	Change to access control						1											1
83	Disable access protocols/ports						1											1
84	Enable access protocols/port						1											1
85	Exhausted resources					3	2											5
86	Functions initiated by automated data processing operators			1														1
87	Hardware additions			1														1
88	Hardware deletions			1														1
89	System hardware maintenance actions			1														1
90	Backup		1			2												3
91	Account lockout		1															1
92	Restore		1															1
93	Application/component intallation					1												1
94	Disable encryption									1								1
95	Enable encryption									1								1
96	Invalid input					1												1
97	Override of human-readable output markings											1						1
98	Copy	1																1
99	overrides the consent directives of a patient/person via the EHRi;																1	1
100	accesses, via the EHRi, data that is locked or masked by instruction of a patient/person;																1	1