More than mere insight, a provider organization is necessarily and ultimately responsible  for determining which CDS services should be called when and what data should be (1) pre-fetched and (2) made available to the service via FHIR API calls.  We try to generically describe this here:  https://cds-hooks.hl7.org/1.0/#trusting-cds-services Propose adding language to the Safety and Security section to discuss this aspect: As with any access to protected patient information, systems should ensure that they have appropriate authorization and audit mechanisms in place to support transparency of use of the data. For more information, refer to  [Security Best Practices] ( https://cds-hooks.org/best-practices/#security). And add to the best practices language about audits and specifically the ability of stakeholders to request information audits. Audit can be performed by monitoring calls that make use of the authorization token provided to the CDS Service in the CDS Hooks request.