SearchCapital Equipment & Field Service

Hospital Security Questionnaire and MDS2 Response

MDS2 and hospital security questionnaire work that pins each question to the device layer that answers it, checks every draft against the product's own evidence, and stops the package when two hospitals were told different things.

See the demo Book a demo

Follow the patient data question from 08:14 to a fix ↓

Watch with transcript →

The problem

Two hospitals were told two things about the same pump software

A hospital's third-party risk team sends a spreadsheet of questions with a deal date attached. The coordinator copies answers from the last questionnaire that looked similar, sometimes for another product or an older release, and sends the ones nobody can answer to product security by email.

Nobody checks the new answer against the answers already given to other hospitals for that version, or against the parts list that shipped with it. A library answer carried forward from the last release can quietly contradict the new software, and the hospital that heard it never gets a correction.

Built forProduct security officersSales engineersQuestionnaire teamsDocument control approvers

The Problem Today

Answers are copied from older questionnaires, so two hospitals hear two different things about the same device.

216: lines in the MDS2 security disclosure form published
100–300: questions in each hospital security questionnaire our estimate

Gathered by hand for each reply

Parts list
Threats
Pen test
Old replies

Old release, old answerA library answer outlives the software it describes
Nobody tells the hospitalA wrong answer already sent stays uncorrected

The Solution

Pinned to the deviceEach question sits on the layer of the device that answers it
Checked against evidenceEach draft meets the parts list, threat model, pen test and past answers
Product security settles itA contradiction blocks the package until the officer decides and signs
Each hospital set straightForm revised, drafts refreshed, and hospitals told otherwise corrected

Built-in controls

Nothing leaves while answers disagree
A second person reads each typed answer
Unknown questions go to product security

What You Get

Each hospital hears the answer the evidence supports, and the disclosure form is revised to match it.

50%: fewer expert hours per questionnaire our estimate

Corrections queued, not forgottenEach hospital told otherwise gets the corrected answer
Affected form lines revisedDependent form lines found, drafted and signed by document control
Deals stop waitingSecurity review answered while the deal is still warm

One questionnaire, one pump version

214 questions from a health system, and an MDS2 that said no patient data

A health system of 14 hospitals is moving 1,860 infusion pumps to software v5.1. Its questionnaire came in as a spreadsheet at 07:52, due in ten business days.

demoPump, software, health system, hospitals and people are invented, and so is every number shown: all of it is sample data.

0108:14
214 questions pinned to the pump's six layers; 6 drafts disagree
Product security officer
The pump is drawn as its layers, hardware at the bottom and the hospital network at the top, with a tray for company questions. Each question is a pin on the layer that answers it. The agents drafted 194 from 1,412 approved answers, sent 11 about the hospital's own setup to the sales engineer, and left 9 with no approved answer for product security.
0208:15
Patient data at rest: the library says no, and two hospitals were told no
Product security officer
She opens the red pin on the pump application. The draft, carried from v5.0, says the pump keeps no patient data. The evidence checker has struck it through: the parts list carries a database used by the event log, and the threat model says that log holds the patient ID. Two hospitals got the same no this autumn.
0308:15
What has been said, what the evidence says, and her decision, side by side
Product security officer
The settle page puts the library answer and both earlier replies on the left, six sources in the middle, and three choices on the right: approve the answer the agents built from the evidence, edit it, or keep the library answer. Keeping it would overrule the evidence and wait for a second reader. Signing changes the answer for every open v5.1 questionnaire.
0408:16
SBOM line 112: an embedded database, used by the event log service
Product security officer
She opens the parts list at its passage. Line 112 of 186 names the database and the service that uses it. A source only counts as opened once it has stayed on screen for about three seconds, and the package records which sources she opened before she decided anything.
0508:16
Threat model T-22: the event log keeps the patient ID scanned at programming
Product security officer
The threat model entry says the v5.1 event log on internal flash holds the patient ID, drug, dose, rate and alarms, 5,000 events before the oldest is overwritten, encrypted with the key held in the secure element and erased at decommissioning. The library answer was true for v5.0 and is wrong now.
0608:16
She signs yes, and the stack counts 5 contradictions left
Product security officer
She approves the answer built from the evidence and signs it under her own password. The pin turns green and reads settled in her name, compared with six sources. The approved answer moves to a new revision as the one answer for v5.1, and 17 other open questionnaires for that version get the new draft and a fresh check.
0708:19
Four MDS2 lines flip from no to yes in a draft revision B
Document control approver
The MDS2 keeper checked each line against the settled answer and found four that said the pump keeps no personally identifiable information. Revision B changes them, each line cited to the parts list and threat model. Revision A stays effective until document control signs, and while it is known to be wrong the form cannot be exported.
0808:20
Two hospitals queued for a corrected answer, each waiting on the MDS2
Questionnaire coordinator
The correction drafter found both hospitals that were told no and drafted one letter each. Each letter needs the compliance reviewer to read it and waits for revision B, because it refers to the form. The account manager is told when each one goes. Each corrected answer is recorded as sent on its own, so a later settlement starts a new letter.
0908:21
1 of 30 records checked before the package can be signed
Product security officer
The package lists what still stands in the way: 5 contradictions, 9 new answers to approve, 11 hospital-specific answers to read, revision B to sign, and a sample of 19 of the 188 ready answers. She opens the first sampled answer and marks it checked. Compliance reviews the text after her signature, and the coordinator sends it.

Six questions where past answers disagreed with each other or the evidence

The evidence checker blocked the package on each one. One is settled on the day above.

Question	What was found	Settled answer
Patient data at rest	Two hospitals told no; the event log holds the patient ID	Yes, encrypted, erased at decommissioning
Inactivity log-off	One told a fixed 15 minutes, one told 1 to 30	1 to 30 minutes, default 10
Anti-malware	One told yes, one told allow-listing	No anti-malware; allow-listing on a signed read-only image
Encryption library and kernel versions	Versions from an earlier release	The versions in this release's parts list
Wi-Fi security modes	Evidence claims more than the library	Waits for a second product security reader
Remote service	One told none, one told customer-started	Only when the hospital starts it, two factors, logged

demoSample data, from the working solution. Once all six are settled, two hospitals receive six corrected answers in two letters.

Around the package

Queues, evidence and rules behind each hospital security questionnaire

What product security, sales engineering and the coordinator work from between questionnaires.

All open hospital security questionnaires with product, question count, format, due date, stage and queue — **64 open questionnaires**Across four connected products, with format, due date, stage and queue. Signed packages that were re-drafted drop back to sign-off.

Queue of questions with no approved answer, each placed on its device layer and waiting for a product security draft — **No approved answer**Nine new questions the library does not cover. The agents do not guess: an engineer drafts, a second reader approves.

Hospital-specific questions about network, contracts and rollout, waiting on the sales engineer — **About the hospital's own setup**Eleven questions on the hospital's network, contracts and rollout, answered by the sales engineer and read word for word by product security.

Product evidence files for the pump version: software bill of materials lines with version, license and use — **Product files**The SBOM's 186 lines, the threat model, pen test summary, security guide and release notes, read every morning.

Audit trail of the questionnaire: intake, the agents' run, the settled contradiction, the form revision and corrections — **Audit trail**From the spreadsheet's arrival at 07:52 to the first sampled check, people and agents side by side, each signature with its meaning and session.

Settings for sign-off sample, fixed rules, clocks, residency, and roles with their separation of duties — **Sign-off rules and duties**Sample size, fixed blocks, clocks and residency by hospital account, with who may do what and what each role cannot do.

demoSample data, from the working solution.

Who settles, who reads, who signs the form, and who sends

Each person owns one step; nobody approves their own words.

Product security officer

Sees: Contradictions with their sources, and the sample of ready answers
Signs: Settles answers and signs the package

Product security engineer

Sees: Questions with no approved answer, and changes that claim more protection
Signs: Drafts new answers; second-reads typed words

Document control approver

Sees: Draft MDS2 revisions with each changed line cited
Signs: Makes a revision effective

Compliance reviewer

Sees: Every package and correction letter before it leaves
Signs: Signs the outgoing text

Questionnaire coordinator

Sees: The queue, clocks and what blocks each package
Signs: Sends only what product security signed

Who reads the questionnaire

Seven agents read, place and check; none of them settles an answer

They draft from approved answers and block on disagreement. People decide and sign.

Intake reader

Reads spreadsheets, portal exports, PDFs and Word files into questions, keeping the hospital's numbering.

Never answers or rewords a question

Layer placer

Pins each question to the device layer that answers it, from the threat model's architecture.

Never guesses a layer it cannot place

Answer matcher

Drafts from approved answers for this exact software version.

Never uses another version's answer
Never writes a new answer

Evidence checker

Checks each draft against the SBOM, threat model, pen test, MDS2 and earlier answers, and blocks on disagreement.

Never settles a contradiction or unblocks a package

MDS2 keeper

Drafts the next form revision when a settled answer changes a line.

Never makes a revision effective

Correction drafter

Finds each hospital given an answer a settled one replaces, and drafts the letter.

Never sends
Never sends a letter that needs an unsigned form

Package builder

Writes answers back into the hospital's format with the effective form, SBOM and pen test summary.

Never attaches the full threat model or pen test report

Calls on a security questionnaire that only people make

The agents draft and block. These decisions do not move without a person.

Settling a contradictionThe product security officer decides. Keeping the library answer against the evidence waits for a second reader.

A question with no approved answerProduct security writes it. The agents never guess, and a second person approves it into the library.

Making a form revision effectiveDocument control signs each MDS2 revision before a package or letter can carry it.

Sending anything to a hospitalCompliance reads every outgoing text, and the coordinator sends only what product security signed.

Recall and field action historyA question that asks for it is answered only by attaching the signed statement from post-market quality, which the agents do not open or quote.

The evidence each hospital security questionnaire answer is checked against

Read from the product lifecycle and quality management systems, for one software version at a time.

Software bill of materialsEach component, version, license and the service that uses it

Threat modelAssets, threats and controls by layer

Pen test summaryFindings and their state, never the full report

Security guide and release notesWhat the hospital is told to configure, and what changed

The effective MDS2Each line, with the revision in force

Answer library and past repliesApproved answers by version, and what each hospital was told

What product security officers ask about MDS2 and questionnaire work

What is an MDS2, and how does it relate to a hospital security questionnaire?

The MDS2 is the manufacturer disclosure statement for medical device security: a standard form describing a device's security features. Hospitals ask for it alongside their own security questionnaire, and both must agree with each other and with the device's evidence.

What happens when two earlier answers disagree?

The package is blocked until the product security officer settles the answer from the evidence. The settled answer becomes the one approved answer for that version, open drafts are refreshed, and each hospital given the earlier answer is queued for a correction.

Does it answer questions it has never seen?

No. A question with no approved answer goes to product security. An engineer drafts it, and a second person reads the exact words before it enters the library.

Will it change our MDS2 by itself?

No. The MDS2 keeper drafts the revision with each changed line cited. Document control signs it, and until then the old revision stays in force and cannot be exported while a line is known to be wrong.

Does internal security material go to the hospital?

No. The package carries the effective MDS2, the SBOM and the pen test summary. The full threat model and the full pen test report stay inside the company.

What about questions on recall or field action history?

They are answered only by attaching the signed statement from the post-market quality team, as received. No agent opens, summarizes or quotes it.

Capital Equipment & Field Service

Start with one questionnaire and your SBOM
for one software version.

We will pin each question to the device and show you where your past answers disagree.

Book a demo Browse solutions

Hospital Security Questionnaire and MDS2 Response

Two hospitals were told two things about the same pump software

The Problem Today

The Solution

What You Get

214 questions from a health system, and an MDS2 that said no patient data

214 questions pinned to the pump's six layers; 6 drafts disagree

Patient data at rest: the library says no, and two hospitals were told no

What has been said, what the evidence says, and her decision, side by side

SBOM line 112: an embedded database, used by the event log service

Threat model T-22: the event log keeps the patient ID scanned at programming

She signs yes, and the stack counts 5 contradictions left

Four MDS2 lines flip from no to yes in a draft revision B

Two hospitals queued for a corrected answer, each waiting on the MDS2

1 of 30 records checked before the package can be signed