SoD: Collaborative Research: Transparency and Legal Compliance in Software Systems

该项目涉及北卡罗莱纳州立大学和普渡大学之间的合作，涉及医疗保健信息系统的设计。这类系统正变得无处不在，因此越来越容易受到攻击、误用和滥用。这些系统的规范和设计往往忽略了安全和隐私问题。此外，HIPAA（健康保险可移植性和责任法案）等法规以及安全和隐私政策对于用户来说很难理解，对于软件工程师来说，在设计和实现系统时作为指导是复杂的。这个项目定义了帮助分析人员消除规则歧义所需的机制，这样它们就可以被清楚地指定为软件需求。此外，法规越来越多地要求组织遵守法律并对其行为负责。负责确保遵守和问责的个人目前缺乏足够的指导和支持，无法在相关信息系统内管理其法律义务。需要软件控制来保证业务流程遵循特定的需求，特别是那些来自政府法规的需求。为了应对这些挑战，建议的工作需要从整体的角度来设计透明和符合法律的软件系统。主要研究问题包括：-系统需求应如何指定，以便在设计和实施中实现，以确保符合法律和法规？-鉴于软件设计需要满足多个利益相关者（组织、法律/政策制定者、政府机构、公众公民等），这些利益相关者的目标相互矛盾、不一致和难以理解，如何改进这些系统的设计过程，以透明和可审计的方式实现这些要求的融合和满足？该项目阐明了一个需求管理框架，使执行者、业务经理、软件开发人员和审计员能够跨业务单位和/或具有不同角色和技术能力的人员分配法律义务。该框架通过集成整个策略和需求生命周期的可追溯性来改进责任。由于法律和规章管理着社会许多领域的软件系统信息的收集、使用、转移和删除，预计这个项目的广泛影响将是深远的。

This project, involving collaboration between North Carolina State University and Purdue University, addresses the design of Healthcare information systems. Such systems are becoming ubiquitous and thus increasingly subject to attack, misuse and abuse. Specifications and designs of these systems often neglect security and privacy concerns. Moreover, regulations such as HIPAA (Health Insurance Portability and Accountability Act) as well as security and privacy policies are difficult for users to understand and complex for software engineers to use as guides when designing and implementing systems. This project defines mechanisms that are needed to help analysts disambiguate regulations so that they may be clearly specified as software requirements. In addition, regulations are increasingly requiring organizations to comply with the law and account for their actions. Individuals responsible for ensuring compliance and accountability currently lack sufficient guidance and support to manage their legal obligations within relevant information systems. Software controls are needed to provide assurances that business processes adhere to specific requirements, especially those derived from government regulations.To address these challenges, the proposed work takes a holistic view of the design of transparent and legally compliant software systems. Key research questions that are addressed include: -How should system requirements be specified so they may be realized in design and implementation to ensure legal and regulatory compliance? -Given that software designs need to satisfy multiple stakeholders (organizations, law/policy makers, government agencies, public citizens, etc.) having contradictory, inconsistent and difficult to understand objectives, how can the design process of these systems be improved to lead to convergence and satisfaction of these requirements in a transparent and auditable fashion? This project articulates a requirements management framework that enables executives, business managers, software developers and auditors to distribute legal obligations across business units and/or personnel with different roles and technical capabilities. This framework improves accountability by integrating traceability throughout the policy and requirements lifecycle. The broader impacts of this project are expected to be far reaching as law and regulations govern the collection, use, transfer and removal of information from software systems in many spheres of society.