A refined production rule model for aiding in regulatory compliance
Jeremy C. Maxwell, Ana I. Antón · NCSU Libraries Repository (North Carolina State University Libraries) · 2010
Software engineers are being asked to develop software for increasingly regulated environments.When systems are not dependably compliant, companies must pay the high cost of non-compliance, including the cost of lost reputation and brand damage.Regulations represent the minimum level of security and dependability with which systems must comply.We develop a methodology for creating production rule models to aid developers in specifying legally compliant software requirements.By querying production rule models, software engineers can gain valuable knowledge of the legal text.They can perform an initial compliance analysis and obtain preliminary compliance requirements that can be further refined in consultation with a lawyer.We model the law using the legal concepts of rights, obligations, privileges, no-rights, powers, liabilities, immunities, and disabilities.Herein, we develop heuristics for specifying production rules that model legal texts.We refined our methodology within the context of a case study in which we model the Privacy Rule, Part E, of the Health Insurance Portability and Accountability Act (HIPAA).