Towards Regulatory Compliance: Extracting Rights and Obligations to Align Requirements with Regulations
Towards Regulatory Compliance: Extracting Rights and Obligations to Align Requirements with Regulations
复制标题
实现监管合规：提取权利和义务，使要求与法规保持一致
DOI：
--
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
A. Antón
中科院分区：
文献类型：
--
作者：
T. Breaux;Matthew W. Vail;A. Antón
在美国，联邦和州法规规定了软件系统需求必须满足的利益相关者的权利和义务。这些规定通常是模糊的，使推导系统要求的过程特别和容易出错。在医疗保健等高度监管的领域，需要更全面的标准来确保系统要求符合法规。为了满足这一需求，我们阐述了一个过程，称为语义参数化以前用于从隐私目标的权利和义务。在这项工作中，我们将该过程应用于美国健康保险流通和责任法案（HIPAA）的隐私规则。我们提出了我们的方法，从法规中提取和优先考虑的权利和义务，并显示如何语义模型可以用来澄清歧义，通过集中启发和平衡权利与义务。我们的分析结果可以帮助需求工程师、标准组织、法规遵从性官员和利益相关者确保系统符合政策并满足需求
In the United States, federal and state regulations prescribe stakeholder rights and obligations that must be satisfied by the requirements for software systems. These regulations are typically wrought with ambiguities, making the process of deriving system requirements ad hoc and error prone. In highly regulated domains such as healthcare, there is a need for more comprehensive standards that can be used to assure that system requirements conform to regulations. To address this need, we expound upon a process called semantic parameterization previously used to derive rights and obligations from privacy goals. In this work, we apply the process to the privacy rule from the U.S. Health Insurance Portability and Accountability Act (HIPAA). We present our methodology for extracting and prioritizing rights and obligations from regulations and show how semantic models can be used to clarify ambiguities through focused elicitation and to balance rights with obligations. The results of our analysis can aid requirements engineers, standards organizations, compliance officers, and stakeholders in assuring systems conform to policy and satisfy requirements