Which resource is a record of an event made for purposes of maintaining a security log, including detection of intrusion attempts and monitoring for inappropriate usage?

• A. Provenance
• B. Consent
• C. DocumentManifest
• D. AuditEvent

Answer: (D)

This question tests understanding of which FHIR resource is used to record events for security auditing. AuditEvent is designed to log actions that occur within a system—what happened, who did it, when it happened, and what resources were involved—providing a traceable record for intrusion detection, security monitoring, and compliance. Provenance tracks the origin and history of a resource’s creation and transformation, but it’s not a system-wide security log. Consent is about patient data usage permissions, not auditing events. DocumentManifest groups documents for workflow purposes, not security event logging. So AuditEvent is the best fit for maintaining a security log and monitoring for inappropriate usage.