CPMS Medical Software Development & Integration 2 — Questions and Answers
Question 1: Which IEC 62304 software safety class requires the most rigorous development and maintenance processes?
- Class A
- Class B
- Class C (Correct answer)
- Class D
Correct answer: Class C
IEC 62304 Class C applies to software where a failure could result in death or serious injury, requiring the highest level of rigor.
Question 2: In HL7 FHIR, what is the primary purpose of a 'Bundle' resource?
- Authenticate API users
- Group multiple resources into a single transaction or message (Correct answer)
- Define patient demographics
- Encode medical images
Correct answer: Group multiple resources into a single transaction or message
A FHIR Bundle groups multiple resources together, enabling batch operations, transactions, and document assembly.
Question 3: What is 'software of unknown provenance' (SOUP) in the context of IEC 62304?
- Custom-developed code with no documentation
- Pre-existing software not developed under a quality system for the current device (Correct answer)
- Open-source libraries with known CVEs
- Code written by offshore contractors
Correct answer: Pre-existing software not developed under a quality system for the current device
SOUP refers to software items used in medical device software that were not developed under a quality system specifically for the device being developed.
Question 4: Which cryptographic standard is recommended for protecting ePHI in transit under HIPAA Security Rule guidance?
- MD5
- DES
- TLS 1.2 or higher (Correct answer)
- RC4
Correct answer: TLS 1.2 or higher
TLS 1.2 or higher is the current recommended standard for encrypting ePHI in transit, as older protocols are considered insecure.
Question 5: In a risk-based testing approach for medical software, what determines the depth of testing for a given module?
- Lines of code in the module
- The software's safety classification and associated risk (Correct answer)
- Developer seniority
- Project budget allocation
Correct answer: The software's safety classification and associated risk
Risk-based testing prioritizes test depth based on the software's safety class and the severity of potential failures.
Question 6: When integrating a medical device with an EHR via an HL7 v2 ADT message, what does the 'A01' event code signify?
- Patient discharge
- Patient admit (Correct answer)
- Patient transfer
- Patient merge
Correct answer: Patient admit
ADT^A01 is the HL7 v2 event code for a patient admit or visit notification.
Question 7: Which software development lifecycle model is most commonly required by FDA for high-risk medical device software?
- Ad-hoc development
- A documented, risk-managed lifecycle with design controls (Correct answer)
- Agile with no documentation
- Waterfall only
Correct answer: A documented, risk-managed lifecycle with design controls
FDA requires a documented software lifecycle with design controls per 21 CFR Part 820, regardless of whether the team uses agile or waterfall.
CPMS Medical Software Development & Integration 2
Which IEC 62304 software safety class requires the most rigorous development and maintenance processes?