![](bg8.png)
Directive-1995/46/CE (1995). Directive Num. 95/46/CE of
the European Parliament and Council, dated October
24th: about People protection regarding the personal
data management and the free circulation of these
data. DOCE no. L281, 23/11/1995, P.0031-0050.
Directive-2002/58/CE (2002). Directive Num. 2002/58/CE
of the European Parliament and Council, of July 12,
2002, relative to the processing of personal data and
the protection of privacy in the electronic communica-
tions industry (Official Gazette of the European Union
L 201 of 31.7.2002).
Firesmith, D. (2003). Engineering security requirements.
Journal of Object Technology (JOT), 2(1):53–68.
Hughes, R. (2005). Is audit research? the relationships
between clinical audit and social research. Inter-
national Journal of Health Care Quality Assurance,
18(4):289–299.
IEEE-Std.1233-1998 (1998). Guide for Developing System
Requirements Specifications. In Volume 1: Customer
and Terminology Standards The Institute of Electrical
and Electronics Engineers, Inc. IEEE Software Engi-
neering Standards Collection.
IEEE-Std.830-1998 (1998). Guide to Software Require-
ments Specifications (ANSI). In Volume 4: Resource
and Technique Standards The Institute of Electrical
and Electronics Engineers, Inc. IEEE Software Engi-
neering Standards Collection.
ISO/IEC-7498-2:1989 (1989). Information processing sys-
tems. Open Systems Interconnection. Basic Reference
Model. Part 2: Security Architecture.
ISO/IEC-9126-1 (2001). Software Engineering - Product
Quality - Part1: Quality Model.
LOPD (1999). Spanish Constitutional Law 15/1999, De-
cember 13th, on Personal Data Protection. BOE no.
298, 14/12/1999 (In Spanish). http://www.agpd.es.
Lusignan, S., Chan, T., Theadom, A., and Dhoul, N. (2006).
The roles of policy and professionalism in the protec-
tion of processed clinical data: A literature review. In-
ternational Journal of Medical Informatics.
Martinez, M. A., Lasheras, J., Toval, A., and Piattini, M.
(2006). An Audit Method of Personal Data Based on
Requirements Engineering. In Proceedings of the 4th
International Workshop on Security in Information
Systems, (WOSIS’06), In conjunction with ICEIS’06,
Paphos, Cyprus, pages 217–231.
Massacci, F., Prest, M., and Zannone, N. (2005). Using
a security requirements engineering methodology in
practice: The compliance with the italian data protec-
tion legislation. Computer Standards and Interfaces,
27:445–455.
Nicolas, J., Lasheras, J., Toval, A., Ortiz, F. J., and Al-
varez, B. (2006). A collaborative learning experi-
ence in modelling the requirements of teleoperated
systems for ship hull maintenance. In Proceedings
of the Learning Software Organizations + Require-
ments Engineering (LSO+RE 2006), Hannover, Ger-
many, pages 71–80.
Olvingson, C., Hallberg, N., Timpka, T., and Greenes, R.
(2002). Using the critical incident technique to de-
fine a minimal data set for requirements elicitation in
public health. International Journal of Medical Infor-
matics, 68:165–174.
Sandhu, R. and Samarati, P. (1996). Authentication, Access
Control and Audit. ACM Computing Surveys (CSUR),
28(1):241–243.
SMR (1999). Spanish Royal Decree 994/1999, June 11th,
by means of which the Security Measures Regulations
of Automated Files which contain personal data is ap-
proved. BOE no. 151, 25/06/1999, page 24241 (In
Spanish). http://www.agpd.es.
Toval, A., Nicol
´
as, J., Moros, B., and Garcia, F. (2002a).
Requirements Reuse for Improving Information Sys-
tems Security: A Practitioner’s Approach. RE J.,
6(4):205–219.
Toval, A., Olmos, A., and Piattini, M. (2002b). Legal Re-
quirements Reuse: A Critical Success Factor for Re-
quirements Quality and Personal Data Protection. In
RE, pages 95–103. IEEE Computer Society.
Van der Haak, M., Wolff, A., Brandner, R., Drings, P., Wan-
nenmacher, M., and Wetter, T. (2003). Data security
and protection in cross-institutional electronic patient
records. International Journal of Medical Informatics,
70:117–130.
Wadsworth, Y. (1998). What is participatory action re-
search? Action Research International. Paper 2,,
2004.
Weber, R. (1988). EDP Auditing: Conceptual Foundations
and Practice. 2nd Edition. Mc Graw Hill.
REQUIREMENTS ENGINEERING TO AUDIT PRIVACY ISSUES IN MEDICAL AND HEALTH SOFTWARE
81