title: Analyzing privacy requirements: A case study of healthcare in Saudi Arabia.
abstract: Developing legally compliant systems is a challenging software engineering problem, especially in systems that are governed by law, such as healthcare information systems. This challenge comes from the ambiguities and domain-specific definitions that are found in governmental rules. Therefore, there is a significant business need to automatically analyze privacy texts, extract rules and subsequently enforce them throughout the supply chain. The existing works that analyze health regulations use the U.S. Health Insurance Portability and Accountability Act as a case study. In this article, we applied the Breaux and Antón approach to the text of the Saudi Arabian healthcare privacy regulations; in Saudi Arabia, privacy is among the top dilemmas for public and private healthcare practitioners. As a result, we extracted and analyzed 2 rights, 4 obligations, 22 constraints, and 6 rules. Our analysis can assist requirements engineers, standards organizations, compliance officers and stakeholders by ensuring that their systems conform to Saudi policy. In addition, this article discusses the threats to the study validity and suggests open problems for future research.
authors.affiliation: a Faculty of Computing & IT , Northern Border University , Rafha , Saudi Arabia .
authors.forename: Shouki A
authors.initials: SA
authors.lastname: Ebad
authors.affiliation: b Faculty of Computing & IT , King Abdulaziz University , Jeddah , Saudi Arabia , and.
authors.forename: Emad S
authors.initials: ES
authors.lastname: Jaha
authors.affiliation: c College of Computer Science & Information Systems, Jazan University , Jazan , Saudi Arabia.
authors.forename: Mohammed A
authors.initials: MA
authors.lastname: Al-Qadhi
mesh_terms: D003219:Confidentiality / Q000592:standards; D020408:Health Insurance Portability and Accountability Act; D006801:Humans; D008490:Medical Informatics / Q000379:methods / Q000592:standards; D019982:Organizational Case Studies; D028701:Patient Rights; D010817:Physician-Patient Relations; D015203:Reproducibility of Results; D012529:Saudi Arabia; D014481:United States
keywords: Healthcare information systems; Saudi healthcare regulations; privacy; regulations; software requirement engineering