Certified Professional for Medical Software (CPMS) — Questions and Answers

Question 1: Which ONC certification criterion requires EHRs to support patient access to their data via a standardized API?

§170.315(b)(1) – Transitions of Care
§170.315(a)(14) – Implantable device list
§170.315(g)(10) – Standardized API for patient and population services (Correct answer)
§170.315(e)(1) – View, download, and transmit to 3rd party

Correct answer: §170.315(g)(10) – Standardized API for patient and population services

ONC criterion §170.315(g)(10) mandates FHIR R4-based APIs enabling patients and third-party apps to access EHR data without special effort.

Question 2: In a medical software QMS, what is the primary goal of an internal audit?

To review financial expenditures on software development
To identify employees for performance improvement plans
To test software functionality in the production environment
To verify that the QMS is effectively implemented and conforms to planned arrangements and standards (Correct answer)

Correct answer: To verify that the QMS is effectively implemented and conforms to planned arrangements and standards

Internal audits verify that QMS processes are effectively implemented, conform to planned arrangements, and meet the requirements of applicable standards.

Question 3: Which NIST framework publication provides a voluntary framework for improving critical infrastructure cybersecurity, commonly referenced in medical device security programs?

NIST SP 800-171
NIST SP 800-30
NIST Cybersecurity Framework (CSF) (Correct answer)
NIST SP 800-53

Correct answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework (CSF) organizes cybersecurity activities into five core functions—Identify, Protect, Detect, Respond, Recover—and is widely referenced in FDA guidance for medical device security.

Question 4: A medical software trainer discovers that certain users consistently skip a mandatory data entry field, leading to incomplete patient records. What corrective action is MOST appropriate?

Conduct targeted retraining focused on the rationale and impact of the field (Correct answer)
Report the users to HR without additional support
Disable the mandatory field to reduce user friction
Remove the field from the interface during the next update

Correct answer: Conduct targeted retraining focused on the rationale and impact of the field

Targeted retraining that explains the clinical and compliance reasons for mandatory fields motivates behavior change more effectively than punitive measures.

Question 5: In medical software risk management, what is a 'fault tree analysis' (FTA) used for?

Mapping software user interface navigation flows
Identifying combinations of events and failures that could lead to an undesired top-level event or hazard (Correct answer)
Documenting network topology for health IT infrastructure
Tracking the number of software defects per development sprint

Correct answer: Identifying combinations of events and failures that could lead to an undesired top-level event or hazard

FTA is a top-down, deductive analysis that identifies combinations of events and failures that could lead to a specific undesired hazardous event.

Question 6: In the context of healthcare data warehousing, what is a 'slowly changing dimension' (SCD) Type 2?

Ignoring historical changes and keeping only current values
Storing both old and new values in the same row
Overwriting the existing record with new values
Maintaining full history by adding a new row for each change (Correct answer)

Correct answer: Maintaining full history by adding a new row for each change

SCD Type 2 preserves historical data by inserting a new row each time an attribute changes, with effective dates to track when each version was valid.

Question 7: How do healthcare compliance audits ensure security in medical software?

By focusing solely on improving system performance
By reducing the software's ability to store data
By evaluating the software's compliance with security standards and identifying risks (Correct answer)
By ensuring that software does not collect any patient data

Correct answer: By evaluating the software's compliance with security standards and identifying risks

Healthcare compliance audits are critical for ensuring security in medical software by systematically evaluating its adherence to established security standards and regulations. These audits identify potential vulnerabilities, weaknesses, and non-compliance issues within the software and its operational environment. By pinpointing risks, audits enable organizations to implement corrective actions, thereby strengthening security posture and protecting patient data.

Question 8: In a threat modeling exercise for a networked infusion pump, the STRIDE model categorizes 'an attacker forging dosage commands by impersonating a clinician workstation' under which threat category?

Tampering
Information Disclosure
Spoofing (Correct answer)
Elevation of Privilege

Correct answer: Spoofing

Spoofing in the STRIDE model refers to an attacker illegitimately assuming the identity of another user, system, or device—exactly what occurs when commands are forged by impersonating a legitimate clinician workstation.

Question 9: When documenting software architecture for a Class C medical device under IEC 62304, which artifact is explicitly required?

Source code comments only
Software architecture specification identifying software items and their interfaces (Correct answer)
Marketing brochure
User manual draft

Correct answer: Software architecture specification identifying software items and their interfaces

IEC 62304 requires a documented software architecture that identifies all software items and their interfaces for Class B and C devices.

Question 10: Which approach is MOST important for CPMS professionals when applying technical procedures?

Adhering to established protocols while adapting to specific conditions (Correct answer)
Following personal shortcuts developed through experience
Applying the same technique in every situation without variation
Using the fastest method available regardless of standards

Correct answer: Adhering to established protocols while adapting to specific conditions

Technical procedures require adherence to established protocols as a foundation, with professional judgment to adapt appropriately to specific conditions. This balance ensures both consistency and effectiveness.

Question 11: A health information exchange (HIE) receives duplicate patient records from two hospitals. Which process is used to resolve this?

Record linkage / patient matching (Correct answer)
Data normalization
Audit logging
Schema mapping

Correct answer: Record linkage / patient matching

Record linkage (also called patient matching) identifies and merges duplicate patient records using demographic and other identifying attributes.

Question 12: What distinguishes software verification from software validation in the medical software lifecycle?

Verification is performed by users in clinical settings; validation is performed by developers
Verification occurs after validation in the development sequence
Verification applies only to hardware interfaces; validation applies only to software functions
Verification checks outputs against specifications; validation checks against user needs (Correct answer)

Correct answer: Verification checks outputs against specifications; validation checks against user needs

Verification confirms software meets specified requirements ('Are we building it right?') while validation confirms the product meets user needs in the intended environment ('Are we building the right product?').

Question 13: Which standard defines the structure and content requirements for a Continuity of Care Document (CCD)?

DICOM SR
FHIR R4 Patient resource
X12 837 transaction set
HL7 CDA with HITSP C32 constraints (Correct answer)

Correct answer: HL7 CDA with HITSP C32 constraints

The CCD is based on HL7's Clinical Document Architecture (CDA) with specific constraints defined by HITSP C32 to support care transitions.

Question 14: A Corrective and Preventive Action (CAPA) system under 21 CFR 820.100 requires that the effectiveness of implemented corrective actions be:

Assessed only when the nonconformance recurs within 90 days
Reported to FDA within 30 days of CAPA closure
Verified to ensure corrective action does not adversely affect the finished device (Correct answer)
Documented but not necessarily verified for Class II device manufacturers

Correct answer: Verified to ensure corrective action does not adversely affect the finished device

21 CFR 820.100(a)(6) requires that manufacturers verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device.

Question 15: What is a 'software item' as defined in IEC 62304?

Only the compiled executable files shipped as part of a medical device
Any physical hardware component that executes software instructions
The complete finished software product approved for market release
Any identifiable part of a computer program including source code, object code, and data (Correct answer)

Correct answer: Any identifiable part of a computer program including source code, object code, and data

IEC 62304 broadly defines a software item as any identifiable part of a computer program, from a complete software system down to a single module, including source code, object code, and data.

Question 16: Which type of software anomaly in IEC 62304 must always be investigated and resolved before software release?

Performance degradation under extreme load
Minor UI cosmetic defects
All known anomalies regardless of severity
Anomalies with unacceptable residual risk (Correct answer)

Correct answer: Anomalies with unacceptable residual risk

IEC 62304 requires that software anomalies that could result in unacceptable risk must be resolved or mitigated before release.

Question 17: What is the primary purpose of a formal software release process in medical device development?

To ensure a controlled, documented transition of software from development to production (Correct answer)
To archive software source code in a secure long-term repository
To train clinical staff on new software features before deployment
To market the approved software to healthcare providers and end users

Correct answer: To ensure a controlled, documented transition of software from development to production

The software release process ensures software transitions from development to production in a controlled and documented manner, verifying all lifecycle activities are complete before clinical deployment.

Question 18: What is the purpose of a Risk/Benefit analysis in ISO 14971?

To compare the device's cost against competitor products
To assess staff workload versus productivity in development teams
To determine the financial return on investment for medical device development
To evaluate whether the expected clinical benefits of a device outweigh its risks to justify its use (Correct answer)

Correct answer: To evaluate whether the expected clinical benefits of a device outweigh its risks to justify its use

Risk/benefit analysis determines whether the expected clinical benefits of the medical device outweigh the residual risks, justifying the device's availability to patients.

Question 19: What is 'nonconformance' in medical software quality management?

A user preference that differs from the software design
Software that has not yet been validated
A failure to meet a specified requirement, standard, or regulatory obligation (Correct answer)
A feature request submitted after initial development

Correct answer: A failure to meet a specified requirement, standard, or regulatory obligation

Nonconformance is any failure to meet a specified requirement, standard, or regulatory obligation that must be documented and addressed through the QMS.

Question 20: What is the significance of a software 'Change Control' process in medical device software maintenance?

It logs hardware changes unrelated to software
It tracks user login activity within the software
It ensures all software changes are documented, evaluated for impact, and validated before implementation (Correct answer)
It automates software patches without manual review

Correct answer: It ensures all software changes are documented, evaluated for impact, and validated before implementation

Change control ensures that every software modification is formally documented, assessed for risk and validation impact, and approved before deployment.

Question 21: Which document in the EU MDR technical documentation describes how a manufacturer has demonstrated conformity with all applicable General Safety and Performance Requirements?

Risk Management Report
Clinical Evaluation Report (CER)
Post-Market Surveillance Plan
GSPR Checklist (formerly Essential Requirements Checklist) (Correct answer)

Correct answer: GSPR Checklist (formerly Essential Requirements Checklist)

The GSPR Checklist (General Safety and Performance Requirements Checklist) maps each requirement from Annex I of the MDR to the specific technical documentation, standards, or tests used to demonstrate conformity.

Question 22: Under GDPR, when a medical software company based outside the EU processes health data of EU residents as part of its SaaS offering, it must:

Obtain a waiver from the European Data Protection Board before processing
Apply GDPR only if it has a physical office in an EU member state
Only comply if annual data processing volume exceeds 10,000 EU data subjects
Comply with GDPR regardless of its location due to the regulation's extraterritorial scope (Correct answer)

Correct answer: Comply with GDPR regardless of its location due to the regulation's extraterritorial scope

GDPR Article 3 establishes extraterritorial scope: it applies to any organization processing EU residents' personal data when offering goods or services to them, regardless of the organization's geographic location.

Question 23: What is the purpose of security standards in healthcare software?

To reduce the cost of data management
To encourage data sharing without restrictions
To protect patient data and comply with legal security requirements (Correct answer)
To make healthcare systems more complex

Correct answer: To protect patient data and comply with legal security requirements

Security standards in healthcare software are crucial for safeguarding highly sensitive patient data from breaches and unauthorized access. They also ensure that healthcare organizations comply with stringent legal and regulatory requirements, such as HIPAA, which mandate specific protections for protected health information. Adherence to these standards helps maintain patient trust and avoids significant legal penalties.

Question 24: IEC 62443 is an international standard series primarily focused on:

Clinical evaluation methodology
Cybersecurity for industrial automation and control systems (Correct answer)
Usability engineering for medical devices
Risk management for medical devices

Correct answer: Cybersecurity for industrial automation and control systems

IEC 62443 addresses cybersecurity for industrial automation and control systems (IACS), and its principles are increasingly applied to medical device cybersecurity alongside FDA guidance.

Question 25: The HITRUST CSF (Common Security Framework) is best described as:

A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations (Correct answer)
A state-level regulation governing health data privacy in California
An FDA-mandated certification program for medical device manufacturers
A voluntary guideline published by NIST specifically for hospital cybersecurity programs

Correct answer: A prescriptive, certifiable framework that harmonizes HIPAA, NIST, ISO 27001, and other standards for healthcare organizations

HITRUST CSF is a certifiable framework that consolidates requirements from multiple regulations and standards (HIPAA, NIST, ISO 27001, PCI DSS, etc.) into a single, prescriptive set of controls tailored for healthcare organizations.

Question 26: In medical software risk management, what does the acronym FMEA stand for?

Formal Medical Equipment Assessment
Fault Management and Error Avoidance
Functional Medical Error Analysis
Failure Modes and Effects Analysis (Correct answer)

Correct answer: Failure Modes and Effects Analysis

FMEA stands for Failure Modes and Effects Analysis, a systematic method for identifying potential failure modes and their effects on system performance and safety.

Question 27: A medical software support team wants to reduce repeat contacts from users asking the same questions. Which solution is MOST sustainable long-term?

Limit the hours that support is available to discourage non-urgent contacts
Build and maintain a searchable self-service knowledge base with FAQs and video tutorials (Correct answer)
Route all questions through the department manager before escalation
Add more support staff to handle call volume

Correct answer: Build and maintain a searchable self-service knowledge base with FAQs and video tutorials

A well-maintained self-service knowledge base empowers users to find answers independently, reducing repeat support contacts sustainably.

Question 28: FDA's guidance on Predetermined Change Control Plans (PCCPs) for AI/ML-based Software as a Medical Device (SaMD) primarily addresses:

The labeling requirements for disclosing AI involvement to patients
Mandatory post-market surveillance intervals for AI-based diagnostic tools
The clinical validation requirements for initial SaMD approval only
How manufacturers can pre-specify algorithm changes without submitting a new 510(k) for each modification (Correct answer)

Correct answer: How manufacturers can pre-specify algorithm changes without submitting a new 510(k) for each modification

PCCPs allow manufacturers to describe anticipated modifications to AI/ML-based SaMD in advance; if FDA approves the PCCP, manufacturers can implement those changes without a separate premarket submission for each modification.

Question 29: In Certified Professional for Medical Software practice, what is the FIRST step when a safety hazard is identified in the workplace?

Wait for a supervisor to notice the issue
Document it for the next safety audit
Continue working and report at end of shift
Immediately secure the area and report the hazard (Correct answer)

Correct answer: Immediately secure the area and report the hazard

When a safety hazard is identified, the immediate priority is to secure the area to prevent injury and report the hazard through proper channels. Delaying action increases the risk of incidents.

Question 30: The FDA's 2023 final rule on cybersecurity for medical devices (Section 524B of FD&C Act) requires manufacturers to submit a Software Bill of Materials (SBOM). The primary purpose of the SBOM is to:

Enable identification of software components and their known vulnerabilities (Correct answer)
Replace the need for penetration testing
Satisfy FDA's Unique Device Identifier (UDI) requirements
Document the software development lifecycle process

Correct answer: Enable identification of software components and their known vulnerabilities

An SBOM provides a comprehensive inventory of software components, enabling manufacturers and users to rapidly identify which products are affected when new vulnerabilities in third-party components are disclosed.

Question 31: What is a 'hazardous situation' as defined in ISO 14971?

A software defect that has already caused patient harm
A failed test case in the validation protocol
A circumstance in which people, property, or the environment are exposed to one or more hazards (Correct answer)
A regulatory violation identified during an audit

Correct answer: A circumstance in which people, property, or the environment are exposed to one or more hazards

A hazardous situation is defined as a circumstance in which people, property, or the environment are exposed to one or more hazards.

Question 32: What is the primary purpose of a software detailed design document in medical device software development?

To document the results of usability testing sessions
To specify how each software unit will be implemented, including algorithms and data structures (Correct answer)
To describe how the software will be marketed to end users
To outline the training requirements for clinical staff

Correct answer: To specify how each software unit will be implemented, including algorithms and data structures

The software detailed design document specifies how each software unit will be implemented, providing enough detail for developers to write code and for reviewers to verify correctness.

Question 33: In ISO 14971 risk management, what is the correct sequence of the risk management process?

Risk evaluation → Risk control → Risk analysis → Residual risk evaluation
Risk analysis → Risk evaluation → Risk control → Residual risk evaluation (Correct answer)
Risk control → Risk analysis → Risk evaluation → Residual risk evaluation
Risk control → Residual risk evaluation → Risk analysis → Risk evaluation

Correct answer: Risk analysis → Risk evaluation → Risk control → Residual risk evaluation

ISO 14971 defines the sequence as: risk analysis, then risk evaluation, followed by risk control, and finally residual risk evaluation.

Question 34: Which factor MOST significantly affects the quality of technical outcomes in CPMS practice?

The time of day the procedure is performed
The practitioner's training, preparation, and attention to detail (Correct answer)
The speed at which procedures are completed
The brand of equipment being used

Correct answer: The practitioner's training, preparation, and attention to detail

The quality of technical outcomes depends primarily on the practitioner's level of training, thorough preparation, and careful attention to detail. While equipment matters, the professional's competence is the most significant factor.

Question 35: Under HIPAA's Security Rule, which of the following is classified as an 'addressable' rather than 'required' implementation specification?

Audit controls
Unique user identification
Encryption and decryption of ePHI at rest (Correct answer)
Emergency access procedure

Correct answer: Encryption and decryption of ePHI at rest

Encryption of ePHI at rest is an addressable specification, meaning covered entities must assess whether it is reasonable and appropriate given their environment, whereas unique user identification and audit controls are required specifications.

Question 36: Why is interoperability important in healthcare software?

To allow different systems to communicate and exchange data effectively (Correct answer)
To make data storage more complex
To limit the sharing of data between systems
To prevent data integration across systems

Correct answer: To allow different systems to communicate and exchange data effectively

Interoperability is vital in healthcare software because it allows different systems, applications, and devices to communicate, exchange, and interpret data effectively. This seamless data flow is essential for comprehensive patient care, as it ensures that information from various sources, like labs, pharmacies, and different clinics, can be accessed and understood by all authorized providers. Without interoperability, healthcare systems would operate in isolation, hindering efficient and coordinated patient management.

Question 37: Which principle of the Privacy Rule allows a covered entity to disclose PHI to public health authorities for disease surveillance without obtaining patient authorization?

Minimum Necessary Exception
Treatment, Payment, and Operations (TPO) provision
Incidental Disclosure provision
Public Interest and Benefit Activities exception (Correct answer)

Correct answer: Public Interest and Benefit Activities exception

HIPAA's Public Interest and Benefit Activities exception (45 CFR 164.512) permits covered entities to disclose PHI without authorization for public health activities including disease surveillance, outbreak investigations, and reporting to public health authorities.

Question 38: Under 21 CFR Part 11, which of the following is required for an electronic signature to be considered legally binding for medical records?

A scanned image of a handwritten signature
A unique combination of identification components (e.g., username + password) with a manifest linking the signature to the record (Correct answer)
A printed name and date typed into a text field
Any digital image attached to a document

Correct answer: A unique combination of identification components (e.g., username + password) with a manifest linking the signature to the record

21 CFR Part 11 requires electronic signatures to consist of at least two distinct components and be linked to their associated electronic records to be legally binding.

Question 39: What is the role of API integration in medical software?

To limit data exchange across systems
To allow systems to share data and integrate seamlessly for better patient care (Correct answer)
To increase the complexity of healthcare software
To reduce the number of users accessing healthcare systems

Correct answer: To allow systems to share data and integrate seamlessly for better patient care

API (Application Programming Interface) integration in medical software is crucial because it allows different systems to communicate and share data seamlessly. This enables various healthcare applications, such as EHRs, lab systems, and billing software, to exchange information efficiently. The result is improved workflow, reduced manual data entry, and better-coordinated patient care through a unified data ecosystem.

Question 40: Why is testing and validation crucial in healthcare software development?

To make the software compatible with all operating systems
To ensure software works as intended and meets safety and compliance standards (Correct answer)
To reduce software features for simplicity
To create software that functions unpredictably

Correct answer: To ensure software works as intended and meets safety and compliance standards

Testing and validation are crucial in healthcare software development to ensure the software functions precisely as intended and meets stringent safety and compliance standards. Rigorous testing identifies and rectifies bugs, security vulnerabilities, and performance issues before deployment. This process is vital for guaranteeing the reliability, accuracy, and safety of systems that directly impact patient care.

Question 41: When a CPMS professional identifies a potential regulatory violation, the CORRECT first step is to:

Document the violation and report it through proper channels (Correct answer)
Wait to see if it resolves on its own
Address it only if directly affected
Discuss it casually with coworkers

Correct answer: Document the violation and report it through proper channels

Proper documentation and reporting through established channels is the correct first step when identifying a potential violation. This ensures accountability, creates a paper trail, and allows appropriate parties to investigate and resolve the issue.

Question 42: Which regulatory requirement is UNIVERSAL across all Certified Professional for Medical Software practice settings?

Working exclusively during business hours
Maintaining current certification and meeting continuing education requirements (Correct answer)
Using specific proprietary software systems
Limiting services to local jurisdictions only

Correct answer: Maintaining current certification and meeting continuing education requirements

Maintaining current certification and meeting continuing education requirements is a universal regulatory requirement. Regardless of practice setting, professionals must keep their credentials current and demonstrate ongoing competency through continuing education.

Question 43: What is the purpose of a Risk Management File under ISO 14971?

To list all regulatory submissions made for the device
To document customer complaints related to the device
To store employee training records for device development staff
To provide a comprehensive repository of all risk management activities and records for a device (Correct answer)

Correct answer: To provide a comprehensive repository of all risk management activities and records for a device

The Risk Management File is a comprehensive repository containing all risk management plans, analyses, evaluations, and reports for a medical device.

Question 44: What is the main goal of medical software integration?

To reduce the cost of medical devices
To eliminate the need for electronic health records
To store data in one place
To connect various healthcare systems for better data sharing (Correct answer)

Correct answer: To connect various healthcare systems for better data sharing

The main goal of medical software integration is to connect various disparate healthcare systems, enabling seamless data sharing across different platforms. This allows for a unified view of patient information, improving coordination of care and operational efficiency. Integration eliminates data silos, ensuring that all relevant healthcare providers have access to comprehensive patient data when needed.

Question 45: Under FDA 21 CFR Part 11, what is required when training records for medical software users are stored electronically?

Records only need to be stored locally on the trainer's workstation
Electronic records must be accurate, accessible, and protected from alteration (Correct answer)
Records can be deleted after one year
Digital signatures are optional for training completion records

Correct answer: Electronic records must be accurate, accessible, and protected from alteration

FDA 21 CFR Part 11 mandates that electronic records be accurate, reliable, and protected from unauthorized modification to ensure regulatory compliance.

Question 46: Which risk control measure has the highest priority according to ISO 14971?

Information for safety (warnings and labels)
Protective measures in the device or manufacturing process
Inherent safety by design (Correct answer)
User training and instructions

Correct answer: Inherent safety by design

ISO 14971 establishes inherent safety by design as the highest-priority risk control measure, followed by protective measures, then information for safety.

Question 47: What is the difference between 'risk' and 'hazard' in ISO 14971 terminology?

They are synonymous terms used interchangeably in the standard
Risk applies to software only; hazard applies to hardware only
A hazard is a confirmed harm event; risk is the potential for future harm
A hazard is a potential source of harm; risk is the combination of probability of harm and its severity (Correct answer)

Correct answer: A hazard is a potential source of harm; risk is the combination of probability of harm and its severity

In ISO 14971, a hazard is a potential source of harm, while risk is defined as the combination of the probability that harm occurs and the severity of that harm.

Question 48: Which standard defines quality management system requirements specifically for medical device organizations?

IEC 62304:2006
ISO 13485:2016 (Correct answer)
ISO 9001:2015
ISO 14971:2019

Correct answer: ISO 13485:2016

ISO 13485:2016 specifies QMS requirements specifically for organizations involved in the design, production, and servicing of medical devices.

Question 49: How do healthcare regulations impact data management systems?

They restrict the use of any data in healthcare systems
They allow healthcare organizations to disregard data privacy
They ensure that data is handled securely and in compliance with privacy laws (Correct answer)
They encourage the sharing of all data without restrictions

Correct answer: They ensure that data is handled securely and in compliance with privacy laws

Healthcare regulations significantly impact data management systems by mandating that data is handled securely and in strict compliance with privacy laws like HIPAA. These regulations dictate how patient information must be collected, stored, accessed, and shared, requiring robust security measures, audit trails, and consent protocols. Compliance is essential to protect patient privacy, maintain trust, and avoid severe legal penalties.

Question 50: Why is compliance with healthcare regulations important in software development?

To limit the software's functionality
To increase the cost of software development
To avoid legal consequences in non-healthcare-related industries
To ensure the software complies with legal and security standards (Correct answer)

Correct answer: To ensure the software complies with legal and security standards

Compliance with healthcare regulations is paramount in software development to ensure the software adheres to all legal and security standards governing patient data. This includes meeting requirements for data privacy, security, and interoperability, such as those set by HIPAA. Non-compliance can lead to significant legal penalties, reputational damage, and compromised patient trust, making it a critical aspect of responsible software development.

Question 51: In medical software quality assurance, what is the purpose of a Corrective and Preventive Action (CAPA) system?

To document user complaints without requiring investigation
To schedule routine software updates and patches
To track employee attendance during software development
To investigate nonconformities, determine root causes, and implement actions to prevent recurrence (Correct answer)

Correct answer: To investigate nonconformities, determine root causes, and implement actions to prevent recurrence

CAPA systems investigate nonconformities and defects, identify root causes, and implement both corrective actions to fix current issues and preventive actions to stop recurrence.

Question 52: In a FHIR RESTful API, which HTTP method is used to create a new resource on the server?

GET
PUT
DELETE
POST (Correct answer)

Correct answer: POST

HTTP POST is used in FHIR to create a new resource when the server assigns the resource ID.

Question 53: When escalating a critical patient safety-related software defect, which communication channel is MOST appropriate?

Waiting until the next scheduled maintenance window to report
Posting in the general staff chat channel
Immediate verbal notification followed by a formal written incident report (Correct answer)
Standard email with a low-priority flag

Correct answer: Immediate verbal notification followed by a formal written incident report

Patient safety defects require immediate verbal escalation to ensure rapid response, followed by formal documentation for accountability and regulatory purposes.

Question 54: What is the significance of access control in healthcare systems?

To limit data access to authorized personnel only, protecting patient privacy (Correct answer)
To reduce the number of personnel accessing patient records
To increase the number of users with access to sensitive data
To allow all staff members to access patient data

Correct answer: To limit data access to authorized personnel only, protecting patient privacy

Access control is fundamental in healthcare systems to ensure that only authorized personnel can view, modify, or transmit patient data. This mechanism limits data access based on an individual's role and need-to-know, thereby protecting patient privacy and preventing misuse of sensitive information. Implementing strong access controls is a key component of regulatory compliance and data security.

Question 55: What is the BEST way for a Certified Professional for Medical Software professional to stay current with regulatory changes?

Actively monitor regulatory bodies, attend continuing education, and participate in professional associations (Correct answer)
Rely solely on employer notifications
Depend on colleagues to share updates informally
Check regulations only during certification renewal

Correct answer: Actively monitor regulatory bodies, attend continuing education, and participate in professional associations

Staying current requires a multi-faceted approach: monitoring regulatory agencies directly, attending relevant continuing education programs, and participating in professional associations that disseminate regulatory updates.

Question 56: Which international standard provides a framework for risk management of medical devices, including software?

IEC 60601-1
ISO 14971:2019 (Correct answer)
IEC 62304:2006
ISO 9001:2015

Correct answer: ISO 14971:2019

ISO 14971:2019 is the internationally recognized standard for applying risk management principles throughout the medical device lifecycle, including software.

Question 57: In medical software quality assurance, what does 'design review' accomplish?

It replaces the need for software testing
It documents the business case for software development
It provides systematic examination of design outputs to ensure requirements are met and defects are identified early (Correct answer)
It is a regulatory submission activity required by FDA

Correct answer: It provides systematic examination of design outputs to ensure requirements are met and defects are identified early

Design reviews are formal, systematic examinations of design outputs that identify deficiencies early and confirm that design requirements are being met.

Question 58: When implementing access controls for medical software handling ePHI, which access control model grants permissions based on job functions rather than individual user identity?

Role-Based Access Control (RBAC) (Correct answer)
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Attribute-Based Access Control (ABAC)

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) assigns permissions to roles (e.g., nurse, physician, administrator) rather than individual users, making it the model most commonly recommended for healthcare settings.

Question 59: How do healthcare software systems ensure data accuracy?

By storing data in separate systems without integration
By reducing the frequency of data updates
By allowing users to input data without restrictions
By validating and cross-checking data to ensure accuracy (Correct answer)

Correct answer: By validating and cross-checking data to ensure accuracy

Healthcare software systems ensure data accuracy primarily by implementing validation and cross-checking mechanisms. This involves verifying data inputs against predefined rules, comparing information across different modules, and using algorithms to detect inconsistencies. Such measures minimize errors, ensuring that healthcare providers rely on precise and reliable patient information for critical decisions.

Question 60: What does a Quality Management System (QMS) in the context of medical software development primarily ensure?

That all employees receive annual performance reviews
Consistent processes and controls to meet regulatory and customer requirements for quality (Correct answer)
That medical software is priced competitively in the market
That software is developed using only FDA-approved programming languages

Correct answer: Consistent processes and controls to meet regulatory and customer requirements for quality

A QMS provides a structured framework of processes and controls to ensure medical software consistently meets regulatory requirements and customer quality expectations.

Certified Professional for Medical Software (CPMS)

The CPMS certification validates expertise in the development, testing, and regulatory aspects of medical software, ensuring compliance and safety.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds