EHR standard practice already to keep audit history and will add this as informational comment in CDEX security page ( pre-applied here: http://build.fhir.org/ig/HL7/davinci-ecdx/security.html#supplemental-guidance  ) Although the rationale is to provide the provider with access to the audit information since they are responsible for it, it is out of scope to define a standard approach.  We recommend the commenter create a tracker with the Security WG regarding the standardization of this approach.