CPMS Regulatory Compliance & Security Standards 2 — Questions and Answers
Question 1: Under HIPAA's Security Rule, which of the following is classified as an 'addressable' rather than 'required' implementation specification?
- Unique user identification
- Encryption and decryption of ePHI at rest (Correct answer)
- Emergency access procedure
- Audit controls
Correct answer: Encryption and decryption of ePHI at rest
Encryption of ePHI at rest is an addressable specification, meaning covered entities must assess whether it is reasonable and appropriate given their environment, whereas unique user identification and audit controls are required specifications.
Question 2: A medical software company is preparing for an FDA 510(k) submission. Which document formally declares that the device is substantially equivalent to a predicate device?
- Design History File (DHF)
- 510(k) Summary or Statement (Correct answer)
- Declaration of Conformity
- Technical File
Correct answer: 510(k) Summary or Statement
The 510(k) submission itself—specifically the summary or statement section—formally argues substantial equivalence to a legally marketed predicate device.
Question 3: IEC 62443 is an international standard series primarily focused on:
- Usability engineering for medical devices
- Cybersecurity for industrial automation and control systems (Correct answer)
- Risk management for medical devices
- Clinical evaluation methodology
Correct answer: Cybersecurity for industrial automation and control systems
IEC 62443 addresses cybersecurity for industrial automation and control systems (IACS), and its principles are increasingly applied to medical device cybersecurity alongside FDA guidance.
Question 4: Under 21 CFR Part 820 (FDA Quality System Regulation), the Document Control procedure must ensure that obsolete documents are:
- Immediately destroyed to prevent accidental use
- Promptly removed from points of use or otherwise prevented from unintended use (Correct answer)
- Archived in the same location as current documents with a red stamp
- Retained for 5 years before any action is taken
Correct answer: Promptly removed from points of use or otherwise prevented from unintended use
21 CFR 820.40 requires that obsolete documents be promptly removed from all points of use or otherwise prevented from unintended use, though they may be retained for legal or knowledge-preservation purposes.
Question 5: Which NIST framework publication provides a voluntary framework for improving critical infrastructure cybersecurity, commonly referenced in medical device security programs?
- NIST SP 800-53
- NIST SP 800-171
- NIST Cybersecurity Framework (CSF) (Correct answer)
- NIST SP 800-30
Correct answer: NIST Cybersecurity Framework (CSF)
The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions—Identify, Protect, Detect, Respond, Recover—and is widely referenced in FDA guidance for medical device security.
Question 6: In the EU Medical Device Regulation (MDR 2017/745), which annex specifies the General Safety and Performance Requirements (GSPR) that devices must meet?
- Annex I (Correct answer)
- Annex II
- Annex IX
- Annex XIV
Correct answer: Annex I
Annex I of EU MDR 2017/745 contains the General Safety and Performance Requirements (GSPRs) that all medical devices must satisfy before CE marking can be applied.
Question 7: A hospital's IT team discovers ransomware on a server that stores de-identified medical device log files only. Under HIPAA, is this a reportable breach?
- Yes, all ransomware incidents involving healthcare servers are automatically reportable
- No, because de-identified data is not PHI and HIPAA breach notification does not apply (Correct answer)
- Yes, but only if the data was accessed by an unauthorized party for more than 30 days
- No, because log files are never considered PHI regardless of their content
Correct answer: No, because de-identified data is not PHI and HIPAA breach notification does not apply
HIPAA breach notification applies only to unsecured PHI; properly de-identified data (meeting the Safe Harbor or Expert Determination method) is not PHI, so its compromise does not trigger HIPAA breach notification.
CPMS Regulatory Compliance & Security Standards 2
Under HIPAA's Security Rule, which of the following is classified as an 'addressable' rather than 'required' implementation specification?