docs: @Override
  	public boolean outgoingResponse(RequestDetails theRequestDetails, Bundle theResponseObject, HttpServletRequest theServletRequest, HttpServletResponse theServletResponse) throws AuthenticationException {
  		if (myClientParamsOptional && myDataStore == null) {
  			// auditing is not required or configured, so do nothing here
  			log.debug("No auditing configured.");
  			return true;
  		}
  		if (theResponseObject == null || theResponseObject.isEmpty()) {
  			log.debug("No bundle to audit");
  			return true;
  		}
  		try {
  			log.info("Auditing bundle: " + theResponseObject + " from request " + theRequestDetails);
  			SecurityEvent auditEvent = new SecurityEvent();
  			auditEvent.setEvent(getEventInfo(theRequestDetails));
  			// get user info from request if available
  			Participant participant = getParticipant(theServletRequest);
  			if (participant == null) {
  				log.debug("No participant to audit");
  				return true; // no user to audit - throws exception if client params are required
  			}
  			List<Participant> participants = new ArrayList<SecurityEvent.Participant>(1);
  			participants.add(participant);
  			auditEvent.setParticipant(participants);
  
  			SecurityEventObjectLifecycleEnum lifecycle = mapResourceTypeToSecurityLifecycle(theRequestDetails.getRestOperationType());
  			byte[] query = getQueryFromRequestDetails(theRequestDetails);
  			List<ObjectElement> auditableObjects = new ArrayList<SecurityEvent.ObjectElement>();
  			for (BundleEntry entry : theResponseObject.getEntries()) {
  				IResource resource = entry.getResource();
  				ObjectElement auditableObject = getObjectElement(resource, lifecycle, query);
  				if (auditableObject != null)
  					auditableObjects.add(auditableObject);
  			}
  			if (auditableObjects.isEmpty()) {
  				log.debug("No auditable resources to audit.");
  				return true; // no PHI to audit
  			} else {
  				log.debug("Auditing " + auditableObjects.size() + " resources.");
  			}
  			auditEvent.setObject(auditableObjects);
  			auditEvent.setSource(getSourceElement(theServletRequest));
  			store(auditEvent);
  			return true; // success
  		} catch (Exception e) {
  			log.error("Unable to audit resource: " + theResponseObject + " from request: " + theRequestDetails, e);
  			throw new InternalErrorException("Auditing failed, unable to complete request", e);
  		}
  	}