Abstract
Healthcare audit standards, including FHIR R5 AuditEvent, model a single actor per event. That model holds only while the identity that authenticated, the entity that acted, and the person whose intent is carried out are the same human. When an AI agent operates clinical software those identities separate, and one actor field collapses them back together, so the record can no longer name the accountable human apart from the acting agent.
bh-audit-schema v2.0 makes agent-mediated action attributable through a three-role model, authenticating, acting, and authorizing, with validation that rejects an unattributed agent action by construction. It ships as a JSON Schema producer contract and as a FHIR R5 AuditEvent profile.
HL7's auditevent-OnBehalfOf extension does not close the attribution gap so much
as relocate it: applied to an agent action it moves the requestor flag onto the
agent, so the most standard access-review query in FHIR returns the machine instead of the
accountable clinician. That shape is already visible in published healthcare AI governance
work.
A schema cannot detect a non-cooperating agent, and the specification states the limit and defines emission tiers around it. Telemetry from a production audit deployment shows why the guarantee belongs in the schema and not in guidance: data classification is an optional emitter argument, the two highest-volume services never pass it, and 99.8% of events are therefore unclassified.
Suggested citation
Kumar, T. (2026). Agent Attribution for Healthcare Audit: A FHIR R5 AuditEvent
Profile for Auditing AI-Mediated Access to Protected Health Information.
Behavioral Health Open Source. Technical Report BHOS-TR-2026-03.
https://doi.org/10.5281/zenodo.21682867Extends: BH Audit Schema (2026)