Early Studies in Acquiring Evidentiary, Reusable Business Process Models for Legal Compliance

Government laws and regulations impose legal requirements on information practices in healthcare and finance. These requirements govern the use and disclosure of information across organizations and their business practices. To comply with the law, organizations must demonstrate that they have verifiable procedures in-place to implement these requirements. This paper surveys our experiences acquiring business process models expressed in the Business Process Model Notation (BPMN) using a systematic method. The method requires business process owners to classify regulatory statements using a legal ontology to identify legal requirements. The itemized requirements can then be used to specify elements in a business process model to demonstrate due diligence under the law. The contributions of this paper include lessons learned while acquiring the model with attention to traceability, distinguishing between legally expressed and implied activities and implementing legally imposed deadlines and suspensions. We discuss the lessons learned with examples from the U.S. Health Insurance Portability and Accountability Act (HIPAA).