Software Testing Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Under HIPAA, which type of testing specifically verifies that electronic Protected Health Information (ePHI) is encrypted both at rest and in transit?
- Functional testing
- Security testing (Correct answer)
- Performance testing
- Usability testing
Correct answer: Security testing
Security testing under HIPAA validates that ePHI encryption safeguards are implemented and functioning correctly for both storage and transmission.
Question 2: Which compliance standard specifically governs the testing of software used in payment card processing systems?
- SOX
- HIPAA
- PCI DSS (Correct answer)
- GDPR
Correct answer: PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) sets requirements for all systems that store, process, or transmit cardholder data.
Question 3: In FDA-regulated software testing (21 CFR Part 11), what must be maintained for all test records and audit trails?
- Paper-only backups
- Electronic signatures and audit trails (Correct answer)
- Third-party notarization
- Biometric verification
Correct answer: Electronic signatures and audit trails
21 CFR Part 11 requires that electronic records include audit trails and electronic signatures to ensure integrity and traceability.
Question 4: A tester discovers that a healthcare application logs patient names in plain-text error files accessible to all developers. Under HIPAA, this is a violation of which safeguard category?
- Physical safeguards
- Administrative safeguards
- Technical safeguards (Correct answer)
- Operational safeguards
Correct answer: Technical safeguards
Technical safeguards under HIPAA require controls that protect ePHI from unauthorized access, including proper log handling and access controls.
Question 5: What is the primary purpose of a Verification and Validation (V&V) plan in safety-critical software testing under IEC 62304?
- To document test automation scripts
- To ensure the software meets specified requirements and its intended use (Correct answer)
- To track developer code coverage metrics
- To schedule regression testing cycles
Correct answer: To ensure the software meets specified requirements and its intended use
IEC 62304 V&V plans ensure medical device software is built correctly (verification) and fulfills its intended purpose (validation).
Question 6: Under GDPR, which testing practice helps verify that personal data is not retained longer than necessary?
- Load testing
- Data retention compliance testing (Correct answer)
- Smoke testing
- Alpha testing
Correct answer: Data retention compliance testing
Data retention compliance testing verifies that systems automatically delete or anonymize personal data after the defined retention period expires.
Question 7: Which regulatory framework requires software testers to conduct penetration testing at least annually and after significant infrastructure changes?
- HIPAA
- SOX
- PCI DSS (Correct answer)
- ISO 9001
Correct answer: PCI DSS
PCI DSS Requirement 11.3 mandates penetration testing at least annually and after any significant changes to infrastructure or applications.
Software Testing Regulatory Frameworks & Compliance 2
Under HIPAA, which type of testing specifically verifies that electronic Protected Health Information (ePHI) is encrypted both at rest and in transit?