Attachment 2: Manufacturer Disclosure Statement for Medical Device Security

Manufacturer Disclosure Statement for Medical Device Security – MDS2 Device Category †

Manufacturer †

Document ID

Device Model

Software Revision

Software Release Date

Manufacturer or
Representative
Contact Information:

Document Release Date

Name

Title

Department

Company Name

Telephone #

e-mail

MANAGEMENT OF ELECTRONIC PROTECTED HEALTH INFORMATION (ePHI) As defined by HIPAA Security Rule, 45 CFR Part 164) Yes No N/A Note #
2. Types of ePHI data elements that can be maintained by the device: c.

3. Maintaining ePHI: Can the device

c.
4. Mechanisms used for the transmitting, importing/exporting of ePHI: Can the device c.
f.

ADMINISTRATIVE SAFEGUARDS

Yes No N/A Note #
6. What underlying operating system(s) (including version number) are used by the device?

PHYSICAL SAFEGUARDS

Yes No N/A Note #

TECHNICAL SAFEGUARDS

Yes No N/A Note #
c.
12. Level of owner/operator service access to device operating system: Can the device owner/operator c.
15. Events recorded in device audit log (e.g., user, date/time, action taken): Can the audit log record c.
18. Controls when exchanging ePHI with other devices:
c.

† Recommend use of ECRI’s Universal Medical Device Nomenclature System (UMDNS).

Adapted from Information Security for Biomedical Technology: A HIPAA Compliance Guide, ACCE/ECRI, 2004. ACCE – the American College of Clinical Engineering; ECRI – formerly the Emergency Care Research Institute.

MDS v 1.0 (2004-11-01)

Side 1

©

2004, HIMSS. All rights reserved.

Manufacturer Disclosure Statement for Medical Device Security – MDS2

RECOMMENDED SECURITY PRACTICES

EXPLANATORY NOTES (from questions 1 – 19):
IMPORTANT: Refer to Instructions for the Manufacturers Disclosure Statement for Medical Device Security for the proper interpretation of information provided in this form.

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.

Adapted from Information Security for Biomedical Technology: A HIPAA Compliance Guide, ACCE/ECRI, 2004. ACCE – the American College of Clinical Engineering; ECRI – formerly the Emergency Care Research Institute.

MDS v 1.0 (2004-11-01)

Side 2

©

2004, HIMSS. All rights reserved.

Instructions for the
Ma