This is an interesting question because platforms such as Business Process Management, rules engines, etc. offer people a technology approach to making the organization more flexible to granular process and data access rules.

On one hand though, I have seen cases where having too many business rules just cripples an organization. The organization ends up tripping over itself in both operations and the technology department trying to handle exception processing. Exception processing becomes the norm as opposed to the rare case.

On the other hand, I have seen organizations bottleneck downstream processes because there where too few business rules imposed by the IT system.

I haven't fully formulated my thoughts on general rules, but I know that I generally have opinions in certain circumstances. As a triage mechanism, I probably look at each feature and then formulate an opinion whether there is extreme upside or downside to not implementing any given business rule. In healthcare, there are clearly some downsides and core regulations that need to be followed ...

Any thoughts?

Steve Shu