It's like asking to prove that you haven't been hacked. You can't. The questioner should have been asking about access control, how many people allowed to access, rules about accessing, auditing, how audits are screened for violations, how many people have been caught for violations (if it's zero then you know you have a problem), how they were punished, etc.

Of course hard to see how a Congressperson would know about any of this. Congress should be bringing in domain experts to ask these kinds of questions.