Triage for Legal Requirements

The high cost of non-compliance with laws and regulations that govern software systems makes legal requirements prioritization crucial. In addition, software design, expense, and time constraints all influence how requirements are prioritized. Prioritizing requirements derived from laws and regulations can be untenable using traditional pairwise requirements prioritization techniques because the number of pairwise comparisons grows quadratically with the number of requirements. In this paper, we introduce legal requirements triage––a technique used to subdivide a requirements set into three subsets: (a) implementation ready legal requirements; (b) legal requirements that require further refinement; and (c) non-legal requirements. Legal requirements triage supplements a traditional pairwise requirements prioritization by focusing analysts on implementation ready legal requirements to reduce the number of pairwise comparisons. Herein, we discuss a case study in which we applied these techniques to prioritize 75 functional requirements for the iTrust Medical Records System, an open-source electronic health records system that must comply with the U.S. Health Insurance Portability and Accountability Act (HIPAA). Our study shows that we were able to reduce significantly the number of pairwise comparisons.