Getting the Most Out of the MDS2 Form

March 18, 2020 | Evaluations & Guidance

Preview

The Manufacturer Disclosure Statement for Medical Device Security (MDS2) is a standardized form intended to be filled out by medical device manufacturers to communicate information about their devices' security and privacy characteristics to current device owners and potential buyers, typically healthcare delivery organizations. Currently, most manufacturers provide the form upon request. Information contained in the MDS2 can aid your facility in the device procurement process as well as in risk management. But achieving these benefits requires understanding the form and how to use it.

The form was introduced in 2004 and continues to evolve, with updates published in 2013 and 2019, and it's important to note that the earlier versions of the MDS2 are still in circulation. ECRI considers the 2019 version to be a substantial improvement, providing a lot more information.

For many products, manufacturers are just now starting to complete the 2019 form. For other products, manufacturers may decide not to complete the new form at all, particularly for devices that are no longer being actively marketed. Because organizations will see a mix of 2013 and 2019 (and even a few 2004) versions, they need to understand the differences between the two and have a plan for working with both of them.

The MDS2 was developed by the Healthcare Information and Management Systems Society (HIMSS) and the National Electrical Manufacturers Association (NEMA) and is available for free from NEMA's website. The manufacturer's answers to the questions in MDS2 forms can be used to conduct a high-level assessment of a product's security profile. This can aid in a side-by-side comparison of different models (i.e., identifying high-level differentiators) during procurement. It can also serve as a tool for risk assessment, or to feed a governance, risk, and compliance (GRC) system for further analysis. Questions posed in the MDS2 aid in determining key security characteristics of the device and can be used in the development of a risk profile for it. This can be beneficial in the assessment of both newly purchased devices and...

Access Full Content

Contact us today at 610.825.6000.