CPMS Regulatory Compliance & Security Standards 4 — Questions and Answers
Question 1: Which of the following best describes the 'minimum necessary' standard under HIPAA's Privacy Rule?
- Covered entities must encrypt the minimum required fields when transmitting PHI
- Covered entities must make reasonable efforts to limit PHI use and disclosure to the minimum needed for the intended purpose (Correct answer)
- Business associates must obtain minimum security certifications before accessing PHI
- Covered entities must collect only the minimum amount of PHI during patient registration
Correct answer: Covered entities must make reasonable efforts to limit PHI use and disclosure to the minimum needed for the intended purpose
The minimum necessary standard requires covered entities to take reasonable steps to limit the use, disclosure of, and requests for PHI to the minimum amount necessary to accomplish the intended purpose.
Question 2: Under IEC 62304, a software item classified as Safety Class C must have its software unit verification activities fully documented because:
- Class C software controls or is used to control safety-related functions where failure could cause death or serious injury (Correct answer)
- Class C is the easiest classification and requires the most documentation to compensate
- Regulatory agencies mandate Class C for all networked medical devices regardless of risk
- Class C software is always used in implantable devices only
Correct answer: Class C software controls or is used to control safety-related functions where failure could cause death or serious injury
IEC 62304 Safety Class C applies to software whose failure could result in death or serious injury, requiring the most rigorous development and verification activities including unit-level testing documentation.
Question 3: A Corrective and Preventive Action (CAPA) system under 21 CFR 820.100 requires that the effectiveness of implemented corrective actions be:
- Documented but not necessarily verified for Class II device manufacturers
- Verified to ensure corrective action does not adversely affect the finished device (Correct answer)
- Assessed only when the nonconformance recurs within 90 days
- Reported to FDA within 30 days of CAPA closure
Correct answer: Verified to ensure corrective action does not adversely affect the finished device
21 CFR 820.100(a)(6) requires that manufacturers verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device.
Question 4: When implementing access controls for medical software handling ePHI, which access control model grants permissions based on job functions rather than individual user identity?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) assigns permissions to roles (e.g., nurse, physician, administrator) rather than individual users, making it the model most commonly recommended for healthcare settings.
Question 5: FDA's guidance on Predetermined Change Control Plans (PCCPs) for AI/ML-based Software as a Medical Device (SaMD) primarily addresses:
- How manufacturers can pre-specify algorithm changes without submitting a new 510(k) for each modification (Correct answer)
- The clinical validation requirements for initial SaMD approval only
- Mandatory post-market surveillance intervals for AI-based diagnostic tools
- The labeling requirements for disclosing AI involvement to patients
Correct answer: How manufacturers can pre-specify algorithm changes without submitting a new 510(k) for each modification
PCCPs allow manufacturers to describe anticipated modifications to AI/ML-based SaMD in advance; if FDA approves the PCCP, manufacturers can implement those changes without a separate premarket submission for each modification.
Question 6: In a Business Associate Agreement (BAA) under HIPAA, the business associate is required to:
- Obtain separate consent from each patient before accessing their PHI
- Report any discovery of a security incident to the covered entity (Correct answer)
- Submit an annual compliance attestation to the HHS Office for Civil Rights
- Ensure their subcontractors obtain direct certification from the covered entity
Correct answer: Report any discovery of a security incident to the covered entity
Under 45 CFR 164.314, a business associate must report to the covered entity any security incident of which it becomes aware, including breaches of unsecured PHI.
Question 7: Which document in the EU MDR technical documentation describes how a manufacturer has demonstrated conformity with all applicable General Safety and Performance Requirements?
- Clinical Evaluation Report (CER)
- GSPR Checklist (formerly Essential Requirements Checklist) (Correct answer)
- Post-Market Surveillance Plan
- Risk Management Report
Correct answer: GSPR Checklist (formerly Essential Requirements Checklist)
The GSPR Checklist (General Safety and Performance Requirements Checklist) maps each requirement from Annex I of the MDR to the specific technical documentation, standards, or tests used to demonstrate conformity.
CPMS Regulatory Compliance & Security Standards 4
Which of the following best describes the 'minimum necessary' standard under HIPAA's Privacy Rule?