Evaluating Legal Implementation Readiness Decision-Making

Abstract

Software systems are increasingly regulated. Software engineers therefore must determine which requirements have met or exceeded their legal obligations and which requirements have not. Requirements that have met or exceeded their legal obligations are legally implementation ready, whereas requirements that have not met or exceeded their legal obligations need further refinement. In this paper, we examine how software engineers make these determinations using a multi-case study with three cases. Each case involves assessment of requirements for an electronic health record system that must comply with the US Health Insurance Portability and Accountability Act (HIPAA) and is measured against the evaluations of HIPAA compliance subject matter experts. Our first case examines how individual graduate-level software engineering students assess whether the requirements met or exceeded their HIPAA obligations. Our second case replicates the findings from our first case using a different set of participants. Our third case examines how graduate-level software engineering students assess requirements using the Wideband Delphi approach to deriving consensus in groups. Our findings suggest that the average graduate-level software engineering student is ill-prepared to write legally compliant software with any confidence and that domain experts are an absolute necessity.

Formalizing Privacy Laws for License Generation and Data Repository Decision Automation

“…It is publicly available. 21 We have not yet settled on a standardized format for a module's interview questions, but have implemented a questionnaire for FERPA and Massachusetts privacy law, as well as logic programming rules and license terms for these two domains. The logic programming rules model permissions for deposit, acceptance, and release actions (Sections 3.1 and 3.2) and some transformations (3.3).…”

“…Massey et al [21,22] consider extracting software engineering requirements from legislation and regulations. They determine that typical graduate-level software engineering students can not write legally compliant software with any confidence and develop a taxonomy of ambiguities that might complicate the extraction of requirements.…”

Exploring Current Practices and Challenges of HIPAA Compliance in Software Engineering: Scoping Review

“…Software engineering ensures the privacy, integrity, and accessibility of PHI by strictly following software development best practices and design patterns. From ensuring electronic health record systems are constructed in a manner that is legally compliant [14] to embedding HIPAA privacy rules within healthcare applications through the creation of decision engines [2], software engineering showcases its indispensable capability to navigate and bridge the complex realms of technology and regulatory compliance, thereby ensuring the operational integrity and compliance of health information systems.…”