Extracting and modeling the privacy requirements from HIPAA for healthcare applications

In the U.S. healthcare software applications, the patient privacy is protected under the public law 104-191, also known as the Health Insurance Portability and Accountability Act (HIPAA). To ensure compliance with the law, it´s crucial to extract and model the privacy requirements as early as possible in the software development life cycle, as the cost to implement in later stages will be higher. The main challenge for such a task is the ability to interpret the letter of the law in a format that can then be easily implemented due HIPAA rules being too complex and dense to be used as is by software developers. In this paper we propose a method to analyzes, extracts, and models the privacy requirements in HIPAA.