Regulatory Compliance & Security Standards Flashcards

Under FDA's Software as a Medical Device (SaMD) framework (aligned with IMDRF guidance), which factor is NOT used to determine the SaMD risk category?

Answer: The programming language used to develop the SaMD

IMDRF's SaMD risk framework categorizes risk based on the healthcare situation severity and the significance of the SaMD's output to clinical decision-making—programming language is irrelevant to risk classification.

A medical device company experiences a reportable malfunction under FDA's MDR (Medical Device Reporting) regulation. Under 21 CFR Part 803, a malfunction report must generally be submitted within:

Answer: 30 calendar days of becoming aware of the event

Under 21 CFR 803.50, manufacturers must submit a malfunction MDR within 30 calendar days of becoming aware of a malfunction that would likely cause or contribute to serious injury if it were to recur.

The HITRUST CSF (Common Security Framework) is best described as:

Answer: A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations

HITRUST CSF is a certifiable framework that consolidates requirements from multiple regulations and standards (HIPAA, NIST, ISO 27001, PCI DSS, etc.) into a single, prescriptive set of controls tailored for healthcare organizations.

Under GDPR, when a medical software company based outside the EU processes health data of EU residents as part of its SaaS offering, it must:

Answer: Comply with GDPR regardless of its location due to the regulation's extraterritorial scope

GDPR Article 3 establishes extraterritorial scope: it applies to any organization processing EU residents' personal data when offering goods or services to them, regardless of the organization's geographic location.

In the context of secure software development for medical devices, what is the primary purpose of static application security testing (SAST) tools?

Answer: Analyzing source code or binaries for security vulnerabilities without executing the program

SAST tools analyze source code, bytecode, or binaries at rest to detect security vulnerabilities (such as buffer overflows, injection flaws) without requiring the application to be running.

A manufacturer receives a complaint that their glucose monitor displays values 15% higher than laboratory reference values in a specific patient population. Under 21 CFR Part 820, the FIRST step in the complaint handling process should be:

Answer: Determine whether the complaint represents a reportable event under MDR regulations

21 CFR 820.198 requires that each complaint be reviewed and evaluated to determine whether it represents an event that must be reported to FDA under medical device reporting requirements before or concurrent with investigation.

Which principle of the Privacy Rule allows a covered entity to disclose PHI to public health authorities for disease surveillance without obtaining patient authorization?

Answer: Public Interest and Benefit Activities exception

HIPAA's Public Interest and Benefit Activities exception (45 CFR 164.512) permits covered entities to disclose PHI without authorization for public health activities including disease surveillance, outbreak investigations, and reporting to public health authorities.