Regulatory Compliance & Security Standards Flashcards
7 cards from real CPMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Security Standards flashcards as text
Which of the following best describes the 'minimum necessary' standard under HIPAA's Privacy Rule?
Answer: Covered entities must make reasonable efforts to limit PHI use and disclosure to the minimum needed for the intended purpose
The minimum necessary standard requires covered entities to take reasonable steps to limit the use, disclosure of, and requests for PHI to the minimum amount necessary to accomplish the intended purpose.
Under IEC 62304, a software item classified as Safety Class C must have its software unit verification activities fully documented because:
Answer: Class C software controls or is used to control safety-related functions where failure could cause death or serious injury
IEC 62304 Safety Class C applies to software whose failure could result in death or serious injury, requiring the most rigorous development and verification activities including unit-level testing documentation.
A Corrective and Preventive Action (CAPA) system under 21 CFR 820.100 requires that the effectiveness of implemented corrective actions be:
Answer: Verified to ensure corrective action does not adversely affect the finished device
21 CFR 820.100(a)(6) requires that manufacturers verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device.
When implementing access controls for medical software handling ePHI, which access control model grants permissions based on job functions rather than individual user identity?
Answer: Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) assigns permissions to roles (e.g., nurse, physician, administrator) rather than individual users, making it the model most commonly recommended for healthcare settings.
FDA's guidance on Predetermined Change Control Plans (PCCPs) for AI/ML-based Software as a Medical Device (SaMD) primarily addresses:
Answer: How manufacturers can pre-specify algorithm changes without submitting a new 510(k) for each modification
PCCPs allow manufacturers to describe anticipated modifications to AI/ML-based SaMD in advance; if FDA approves the PCCP, manufacturers can implement those changes without a separate premarket submission for each modification.
In a Business Associate Agreement (BAA) under HIPAA, the business associate is required to:
Answer: Report any discovery of a security incident to the covered entity
Under 45 CFR 164.314, a business associate must report to the covered entity any security incident of which it becomes aware, including breaches of unsecured PHI.
Which document in the EU MDR technical documentation describes how a manufacturer has demonstrated conformity with all applicable General Safety and Performance Requirements?
Answer: GSPR Checklist (formerly Essential Requirements Checklist)
The GSPR Checklist (General Safety and Performance Requirements Checklist) maps each requirement from Annex I of the MDR to the specific technical documentation, standards, or tests used to demonstrate conformity.