CPMS Regulatory Compliance & Security Standards 5 — Questions and Answers
Question 1: Under FDA's Software as a Medical Device (SaMD) framework (aligned with IMDRF guidance), which factor is NOT used to determine the SaMD risk category?
- State of the healthcare situation (critical, serious, non-serious)
- Significance of the information provided by SaMD to the healthcare decision
- The programming language used to develop the SaMD (Correct answer)
- Whether the SaMD is intended to treat, diagnose, drive, or inform clinical management
Correct answer: The programming language used to develop the SaMD
IMDRF's SaMD risk framework categorizes risk based on the healthcare situation severity and the significance of the SaMD's output to clinical decision-making—programming language is irrelevant to risk classification.
Question 2: A medical device company experiences a reportable malfunction under FDA's MDR (Medical Device Reporting) regulation. Under 21 CFR Part 803, a malfunction report must generally be submitted within:
- 5 calendar days (if likely to cause serious injury)
- 30 calendar days of becoming aware of the event (Correct answer)
- 15 calendar days regardless of severity
- 60 calendar days for non-life-threatening malfunctions
Correct answer: 30 calendar days of becoming aware of the event
Under 21 CFR 803.50, manufacturers must submit a malfunction MDR within 30 calendar days of becoming aware of a malfunction that would likely cause or contribute to serious injury if it were to recur.
Question 3: The HITRUST CSF (Common Security Framework) is best described as:
- An FDA-mandated certification program for medical device manufacturers
- A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations (Correct answer)
- A state-level regulation governing health data privacy in California
- A voluntary guideline published by NIST specifically for hospital cybersecurity programs
Correct answer: A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations
HITRUST CSF is a certifiable framework that consolidates requirements from multiple regulations and standards (HIPAA, NIST, ISO 27001, PCI DSS, etc.) into a single, prescriptive set of controls tailored for healthcare organizations.
Question 4: Under GDPR, when a medical software company based outside the EU processes health data of EU residents as part of its SaaS offering, it must:
- Apply GDPR only if it has a physical office in an EU member state
- Comply with GDPR regardless of its location due to the regulation's extraterritorial scope (Correct answer)
- Obtain a waiver from the European Data Protection Board before processing
- Only comply if annual data processing volume exceeds 10,000 EU data subjects
Correct answer: Comply with GDPR regardless of its location due to the regulation's extraterritorial scope
GDPR Article 3 establishes extraterritorial scope: it applies to any organization processing EU residents' personal data when offering goods or services to them, regardless of the organization's geographic location.
Question 5: In the context of secure software development for medical devices, what is the primary purpose of static application security testing (SAST) tools?
- Simulating real-world attack scenarios against a running application
- Analyzing source code or binaries for security vulnerabilities without executing the program (Correct answer)
- Monitoring network traffic to detect intrusion attempts in production
- Validating that encryption algorithms meet FIPS 140-2 requirements
Correct answer: Analyzing source code or binaries for security vulnerabilities without executing the program
SAST tools analyze source code, bytecode, or binaries at rest to detect security vulnerabilities (such as buffer overflows, injection flaws) without requiring the application to be running.
Question 6: A manufacturer receives a complaint that their glucose monitor displays values 15% higher than laboratory reference values in a specific patient population. Under 21 CFR Part 820, the FIRST step in the complaint handling process should be:
- Immediately issue a voluntary recall to FDA
- Determine whether the complaint represents a reportable event under MDR regulations (Correct answer)
- Investigate the complaint to determine the root cause
- Notify all healthcare providers who use the device within 5 business days
Correct answer: Determine whether the complaint represents a reportable event under MDR regulations
21 CFR 820.198 requires that each complaint be reviewed and evaluated to determine whether it represents an event that must be reported to FDA under medical device reporting requirements before or concurrent with investigation.
Question 7: Which principle of the Privacy Rule allows a covered entity to disclose PHI to public health authorities for disease surveillance without obtaining patient authorization?
- Minimum Necessary Exception
- Treatment, Payment, and Operations (TPO) provision
- Public Interest and Benefit Activities exception (Correct answer)
- Incidental Disclosure provision
Correct answer: Public Interest and Benefit Activities exception
HIPAA's Public Interest and Benefit Activities exception (45 CFR 164.512) permits covered entities to disclose PHI without authorization for public health activities including disease surveillance, outbreak investigations, and reporting to public health authorities.
CPMS Regulatory Compliance & Security Standards 5
Under FDA's Software as a Medical Device (SaMD) framework (aligned with IMDRF guidance), which factor is NOT used to determine the SaMD risk category?