Practice Test Geeks(CPMS) Certified Professional for Medical Software Practice Test
← All CPMS Flashcard Decks

Regulatory Compliance & Security Standards Flashcards

7 cards from real CPMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Regulatory Compliance & Security Standards flashcards as text

  1. Under HIPAA's Security Rule, which of the following is classified as an 'addressable' rather than 'required' implementation specification?

    Answer: Encryption and decryption of ePHI at rest

    Encryption of ePHI at rest is an addressable specification, meaning covered entities must assess whether it is reasonable and appropriate given their environment, whereas unique user identification and audit controls are required specifications.

  2. A medical software company is preparing for an FDA 510(k) submission. Which document formally declares that the device is substantially equivalent to a predicate device?

    Answer: 510(k) Summary or Statement

    The 510(k) submission itself—specifically the summary or statement section—formally argues substantial equivalence to a legally marketed predicate device.

  3. IEC 62443 is an international standard series primarily focused on:

    Answer: Cybersecurity for industrial automation and control systems

    IEC 62443 addresses cybersecurity for industrial automation and control systems (IACS), and its principles are increasingly applied to medical device cybersecurity alongside FDA guidance.

  4. Under 21 CFR Part 820 (FDA Quality System Regulation), the Document Control procedure must ensure that obsolete documents are:

    Answer: Promptly removed from points of use or otherwise prevented from unintended use

    21 CFR 820.40 requires that obsolete documents be promptly removed from all points of use or otherwise prevented from unintended use, though they may be retained for legal or knowledge-preservation purposes.

  5. Which NIST framework publication provides a voluntary framework for improving critical infrastructure cybersecurity, commonly referenced in medical device security programs?

    Answer: NIST Cybersecurity Framework (CSF)

    The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions—Identify, Protect, Detect, Respond, Recover—and is widely referenced in FDA guidance for medical device security.

  6. In the EU Medical Device Regulation (MDR 2017/745), which annex specifies the General Safety and Performance Requirements (GSPR) that devices must meet?

    Answer: Annex I

    Annex I of EU MDR 2017/745 contains the General Safety and Performance Requirements (GSPRs) that all medical devices must satisfy before CE marking can be applied.

  7. A hospital's IT team discovers ransomware on a server that stores de-identified medical device log files only. Under HIPAA, is this a reportable breach?

    Answer: No, because de-identified data is not PHI and HIPAA breach notification does not apply

    HIPAA breach notification applies only to unsecured PHI; properly de-identified data (meeting the Safe Harbor or Expert Determination method) is not PHI, so its compromise does not trigger HIPAA breach notification.