Analyzing Regulatory Rules for Privacy and Security Requirements

摘要: Information practices that use personal, financial, and health-related information are governed by US laws regulations to prevent unauthorized disclosure. To ensure compliance under the law, security privacy requirements of relevant software systems must properly be aligned with these regulations. However, describe stakeholder rules, called rights obligations, in complex sometimes ambiguous legal language. These "rules" often precursors undergo considerable refinement analysis before they become implementable. support engineering effort derive from regulations, we present a methodology for directly extracting access obligations regulation texts. The provides statement-level coverage an entire regulatory document consistently identify infer six types data constraints, handle cross references, resolve ambiguities, assign required priorities between avoid unlawful disclosures. We results applying this text Health Insurance Portability Accountability Act (HIPAA) Privacy Rule.