Towards a Framework for Law-Compliant Software Requirements Alberto Siena

During the requirements elicitation phase, analysts have often to take into consideration laws and regulations en-acted by different levels of government. The purpose of this paper is twofold. First, a systematic process is outlined which, given a problem and a collection of legal prescrip-tions, generates a set of requirements that address the prob-lem while complying with the prescriptions. Second, the conceptual framework is outlined, which characterises the process by providing both legal concepts proposed in theo-retical studies in the legal domain and concepts from goal-oriented requirements engineering. The issues and chal-lenges of the proposed framework are also evaluated, with regard to expected results. 1. Software and the law Nowadays, as information systems become more perva-sive, laws are having an increasing impact both on their functionalities and on the people that use them. Laws and regulations enacted by different levels of government are continuously addressed by analysts and developers during the software development activities. However, its system-atic processing is essentially excluded from the mainstream software development processes and tools, and left to the ingenuity of individual designers. It has been estimated that in the Healthcare domain, organisations have spent $17.6 billion over a number of years to align their systems and procedures with a single law, the Health Insurance Portabil-ity and Accountability Act (HIPAA), introduced in 19961. 1Medical privacy- national standards to protect the privacy of personal health information. Office for Civil Rights, US Department of Health and Human Services, 2000