A legal cross-references taxonomy for reasoning about compliance requirements

Abstract

Companies must ensure their software complies with relevant laws and regulations to avoid the risk of costly penalties, lost reputation, and brand damage resulting from non-compliance. Laws and regulations contain internal cross-references to portions of the same legal text, as well as cross-references to external legal texts. These cross-references introduce ambiguities, exceptions, as well as other challenges to regulatory compliance. Requirements engineers need guidance as to how to address crossreferences in order to comply with the requirements of the law. Herein, we analyze each external cross-reference within the U.S. Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the GrammLeach-Bliley Act (GLBA), and the GLBA Financial Privacy Rule to determine whether a cross-reference either introduces a conflicting requirement, a conflicting definition, or refines an existing requirement. Herein, we propose a legal cross-reference taxonomy to aid requirements engineers in classifying cross-references as they specify compliance requirements. Analyzing cross-references enables us to address conflicting requirements that may otherwise thwart legal compliance. We identify five sets of conflicting compliance requirements and recommend strategies for resolving these conflicts.

Electronic health records for cardiovascular medicine

“…The rest of EHRs selected have mainly followed recommendations from HIPAA and recommendations from HL7 for Continuity of Care Document (CDD) or in general. Cross-references taxonomy can be applied to ensure that EHRs used in cardiology comply with HIPAA and HITECH to avoid penalties and lost reputation [41]. 91% of the selected EHRs have received an extra certification from ONC.…”

From RELAW Research to Practice: Reflections on an Ongoing Technology Transfer Project

“…R2: Advanced cross reference handling. Substantial work has already been done on the analysis of cross references [1], [4], [11]. The framework shall be able to leverage the extensive academic research already performed and incorporate means for automatically detecting and resolving cross references.…”

“…Semantic legal metadata has received a lot of attention in the RELAW community. Some notable semantic legal metadata items include modalities (such as rights, obligations and permissions) [7], [12], [6], [13], [14], conditions, consequence, and intent [15], [4], [11], [16].…”

“…In the RE community, there has been considerable research on automated extraction of metadata from legal texts. This metadata covers structural information, for example, the hierarchical organization of legal texts and the cross references (citations) in them [4], [5], as well as semantic information, for example, rights, permissions and obligations [6], [7].…”

Regulatory Rules for Security Requirements of Financial Information Systems: Attempt to Formalize

“…The consequences of failing to comply with these regulations not only may lead to the disclosure of customer confidential information, which could be damaging to their reputations and finances, but also can cause tremendous economic loss and reputation damage for financial providers (Wu et al 2012;. Thus, building a legally compliant system is an engineering problem and is recognized as a significant issue, especially in systems governed by law (Massey et al 2010;Maxwell et al 2012). This challenge comes from ambiguities and domain-specific definitions found in governmental rules (Breaux et al 2006;Otto and Antón 2007).…”