CPMS Regulatory Compliance & Security Standards 2

Question 1

Under HIPAA's Security Rule, which of the following is classified as an 'addressable' rather than 'required' implementation specification?

Accepted Answer

Encryption and decryption of ePHI at rest

Answer

Encryption of ePHI at rest is an addressable specification, meaning covered entities must assess whether it is reasonable and appropriate given their environment, whereas unique user identification and audit controls are required specifications.

Question 2

A medical software company is preparing for an FDA 510(k) submission. Which document formally declares that the device is substantially equivalent to a predicate device?

Accepted Answer

510(k) Summary or Statement

Answer

The 510(k) submission itself—specifically the summary or statement section—formally argues substantial equivalence to a legally marketed predicate device.

Question 3

IEC 62443 is an international standard series primarily focused on:

Accepted Answer

Cybersecurity for industrial automation and control systems

Answer

IEC 62443 addresses cybersecurity for industrial automation and control systems (IACS), and its principles are increasingly applied to medical device cybersecurity alongside FDA guidance.

Question 4

Under 21 CFR Part 820 (FDA Quality System Regulation), the Document Control procedure must ensure that obsolete documents are:

Accepted Answer

Promptly removed from points of use or otherwise prevented from unintended use

Answer

21 CFR 820.40 requires that obsolete documents be promptly removed from all points of use or otherwise prevented from unintended use, though they may be retained for legal or knowledge-preservation purposes.

Question 5

Which NIST framework publication provides a voluntary framework for improving critical infrastructure cybersecurity, commonly referenced in medical device security programs?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions—Identify, Protect, Detect, Respond, Recover—and is widely referenced in FDA guidance for medical device security.

(CPMS) Certified Professional for Medical Software Practice Test

(CPMS) Certified Professional for Medical Software Practice Test

CPMS Regulatory Compliance & Security Standards 2