Preserving traceability and encoding meaning in legal requirements extraction

Information system developers must ensure that their systems comply with government laws and regulations. To demonstrate compliance, developers can trace from statements in law to their system specifications while preserving how they identify and interpret ambiguity. In this paper, we present an application of the legal requirements specification language (LRSL) as a means to encode laws into a machine-readable specification. The encoding reduces ambiguity by making relations between requirements statements explicit. These relations include refinement, pre- and post-conditions, and exceptions that shape the environment in which the developer's system must operate and limiting the behavior of the system to a set of mandatory and discretionary actions. We illustrate the LRSL using a legal excerpt from Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, section164.512(f) governing disclosures of protected health information to law enforcement in the United States.