1. ATNA Repository Access Rob Horn

2. Problem How to aggregate federated audit repositories How to extract audit records for processing How to use media/files/etc. for transferring audit records The present ITI framework is silent on the external capabilities of a repository. Silence on aggregation makes it much harder to merge, restructure, and modify medium to large healthcare facilities and networks.

3. Customer Value A standard approach allows use of COTS A standard approach that is not healthcare specific will have greater advantages –Build on existing infrastructure for cloud systems, warehouse computing, etc.

4. Existing RFC-5424 ATNA specifies use of RFC-5424 ATNA does not require support for RFC-5424 aggregation and federation capabilities. Some ATNA implementations do provide that, because it is part of RFC-5424. Content (ATNA, SystemD, other formats) RFC-5424 Tags Transport (UCP/TCP/TLS)

5. RFC-5424 categorization All RFC-5424 compliant messages (e.g., ATNA plus all other) are tagged with: –Priority –Facility Type –Severity –Time –Original Source –Original application –Original process ID –Message ID ATNA adds structure requirements to the Message Contents.

6. Aggregation RFC 5424 defines a store/filter/forward mechanism ITI could add it as an option so that aggregation, etc. are verified as part of connectathon. The example configurations from the RFC are:

7. Extract A RESTful manner to query for an extract would simplify analysis programs. –SystemD is specifying a query mechanism for extraction, although the present API assumes internal system call not HTTP. A standard format for extracts would simplify analysis programs. –ATNA specifies an XML encoding –SystemD is specifying a JSON encoding for syslog messages –Other groups are specifying a JSON encoding for syslog messages

8. Issues Do we restrict ourselves to healthcare ATNA compliant messages only? or FHIR only? Or DICOM only? How stable are the various works in progress (SystemD, FHIR, Rsyslog, …) To what extent does ITI define specific analysis reports, e.g., “reporting of disclosures”, versus enable implementation of applications for reporting purposes.