CPMS Regulatory Compliance & Security Standards 5

Question 1

Under FDA's Software as a Medical Device (SaMD) framework (aligned with IMDRF guidance), which factor is NOT used to determine the SaMD risk category?

Accepted Answer

The programming language used to develop the SaMD

Answer

IMDRF's SaMD risk framework categorizes risk based on the healthcare situation severity and the significance of the SaMD's output to clinical decision-making—programming language is irrelevant to risk classification.

Question 2

A medical device company experiences a reportable malfunction under FDA's MDR (Medical Device Reporting) regulation. Under 21 CFR Part 803, a malfunction report must generally be submitted within:

Accepted Answer

30 calendar days of becoming aware of the event

Answer

Under 21 CFR 803.50, manufacturers must submit a malfunction MDR within 30 calendar days of becoming aware of a malfunction that would likely cause or contribute to serious injury if it were to recur.

Question 3

The HITRUST CSF (Common Security Framework) is best described as:

Accepted Answer

A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations

Answer

HITRUST CSF is a certifiable framework that consolidates requirements from multiple regulations and standards (HIPAA, NIST, ISO 27001, PCI DSS, etc.) into a single, prescriptive set of controls tailored for healthcare organizations.

Question 4

Under GDPR, when a medical software company based outside the EU processes health data of EU residents as part of its SaaS offering, it must:

Accepted Answer

Comply with GDPR regardless of its location due to the regulation's extraterritorial scope

Answer

GDPR Article 3 establishes extraterritorial scope: it applies to any organization processing EU residents' personal data when offering goods or services to them, regardless of the organization's geographic location.

Question 5

In the context of secure software development for medical devices, what is the primary purpose of static application security testing (SAST) tools?

Accepted Answer

Analyzing source code or binaries for security vulnerabilities without executing the program

Answer

SAST tools analyze source code, bytecode, or binaries at rest to detect security vulnerabilities (such as buffer overflows, injection flaws) without requiring the application to be running.

(CPMS) Certified Professional for Medical Software Practice Test

(CPMS) Certified Professional for Medical Software Practice Test

CPMS Regulatory Compliance & Security Standards 5