HIMSS NEMA Standard HN 1-2013 Manufacturer Disclosure Statement For Medical Device Security.pdf

HIMSS/NEMA Standard HN 1-2013

Manufacturer Disclosure Statement for Medical Device Security

Published by

National Electrical Manufacturers Association 1300 North 17th Street, Suite 900 Rosslyn, Virginia 22209 www.nema.org

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society. All rights including translation into other languages, reserved under the Universal Copyright Convention, the Berne Convention for the Protection of Literary and Artistic Works, and the International and Pan American Copyright Conventions.

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

NOTICE AND DISCLAIMER

The information in this publication was considered technically sound by the consensus of persons engaged in the development and approval of the document at the time it was developed.

Consensus does not necessarily mean that there is unanimous agreement among every person participating in the development of this document.

The National Electrical Manufacturers Association (NEMA) standards and guideline publications, of which the document contained herein is one, are developed through a voluntary consensus standards development process. This process brings together volunteers and/or seeks out the views of persons who have an interest in the topic covered by this publication. While NEMA administers the process and establishes rules to promote fairness in the development of consensus, it does not write the document and it does not independently test, evaluate, or verify the accuracy or completeness of any information or the soundness of any judgments contained in its standards and guideline publications.

NEMA disclaims liability for any personal injury, property, or other damages of any nature whatsoever, whether special, indirect, consequential, or compensatory, directly or indirectly resulting from the publication, use of, application, or reliance on this document. NEMA disclaims and makes no guaranty or warranty, expressed or implied, as to the accuracy or completeness of any information published herein, and disclaims and makes no warranty that the information in this document will fulfill any of your particular purposes or needs. NEMA does not undertake to of this standard or guide.

In publishing and making this document available, NEMA is not undertaking to render professional or other services for or on behalf of any person or entity, nor is NEMA undertaking to perform any duty owed by any person or entity to someone else. Anyone using this document should rely on his or her own independent judgment or, as appropriate, seek the advice of a competent professional in determining the exercise of reasonable care in any given circumstances. Information and other standards on the topic covered by this publication may be available from other sources, which the user may wish to consult for additional views or information not covered by this publication.

NEITHER THE HEALTHCARE INFORMATION AND MANAGEMENT SYSTEMS

SOCIETY (HIMSS) NOR NEMA HAVE POWER, NOR DO THEY UNDERTAKE

TO POLICE OR ENFORCE COMPLIANCE WITH THE CONTENTS OF THIS

DOCUMENT. NEITHER HIMSS NOR NEMA CERTIFY, TEST, OR INSPECT

PRODUCTS, DESIGNS, OR INSTALLATIONS FOR SAFETY OR HEALTH

PURPOSES. ANY CERTIFICATION OR OTHER STATEMENT OF

COMPLIANCE WITH ANY HEALTH OR SAFETY RELATED INFORMATION IN

THIS DOCUMENT SHALL NOT BE ATTRIBUTABLE TO HIMSS OR NEMA AND

IS SOLELY THE RESPONSIBILITY OF THE CERTIFIER OR MAKER OF THE

STATEMENT.

HN 1-2013

Page i

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

CONTENTS

FOREWORD ........................................................................................................... ii CHANGES FROM PREVIOUS (2008) MDS2 REVISION ............................................... iv

Section 1 GENERAL

1.1 SCOPE

1.1.1 The Role of Healthcare Providers in the Security Management Process

1.1.2 The Role of Medical Device Manufacturers in the Security Management Process ...1

1.2 REFERENCES

1.3 DEFINITIONS

1.4 ACRONYMS

Section 2 INSTRUCTIONS FOR OBTAINING, USING, AND COMPLETING MDS2 FORM

2.1 OBTAINING THE MDS2 FORM (PROVIDERS)

2.2 USING THE MDS2 FORM (PROVIDERS)

2.2.1 Device Description

2.2.2 Explanatory notes

2.2.3 Security Capabilities

2.3 COMPLETING THE MDS2 FORM (MANUFACTURERS)

2.3.1 General

2.3.2 MDS2 Form Completion Guidance

Section 3 MDS2 FORM Annex COMPARISON OF PREVIOUS (2008) AND CURRENT (2013) MDS2 (Informative)

Page ii

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

FOREWORD

This document consists of the Manufacturer Disclosure Statement for Medical Device Security (MDS2) form and related instructions how to complete the form. The intent of the MDS2 form is to supply healthcare providers with important information to assist them in assessing the vulnerability and risks associated with protecting private data transmitted or maintained by medical devices and systems. Because security risk assessment spans an entire organization, this document focuses on only those elements of the security risk assessment process associated with medical devices that maintain or transmit private data. A standardized form 1) allows manufacturers to quickly respond to a potentially large volume of information requests from providers regarding the security- related features of the medical devices they manufacture; and 2)

-related information supplied by the manufacturers.

The manufacturer-completed MDS2 should:

(1) Be useful to healthcare provider organizations worldwide. The information presented should be useful for any healthcare delivery organization that aspires to have an effective information security risk management program.

(2) Include device-specific information addressing the technical security-related attributes of the individual device model.

(3) Provide a simple, flexible way of collecting the technical, device-specific elements of the common/typical information needed by provider organizations (device users/operators) to begin medical device information security (i.e., confidentiality, integrity, availability) risk assessments.

HIMSS and NEMA grant permission to make copies and use this form.

PLEASE BE ADVISED The MDS2 form is not intended to nor should it be used as the sole basis for medical device procurement. Writing procurement specifications requires a deeper situation) and the healthcare mission.

Using the information provided by the manufacturer in the MDS2 form together with information collected about the care delivery environment (e.g., through tools such as ACCE, American

Guide for Information Security for Biomedical Technology), risk assessment team can review assembled information and make informed decisions on implementing a local security management plan.

This form was originally adapted from portions of the ACCE/ECRI Biomedical Equipment Survey Form, a key tool found in Information Security for Biomedical Technology: A HIPAA* Compliance Guide (ACCE/ECRI, 2004). This form was published originally in 2004, MDS2 v. 1.0 (2004-11-01) and then as a joint HIMSS/NEMA standard in 2008, HIMSS/NEMA Standard HN 1-2008.

*Health Insurance Portability and Accountability Act.

In 2010, International Electrotechnical Commission standard IEC 80001-1, Application of risk management for IT-networks incorporating medical devices, was published. The standard deals with the application of risk management to IT-networks incorporating medical devices and provides the roles, responsibilities and activities necessary for risk management. In 2012, a Technical Report (TR) supplement to IEC 80001 was published, IEC/TR 80001-2-2, Guidance for the communication of medical device security needs, risks and controls. In this supplement, 19 relevant security capabilities of a medical device or IT component are defined. The 19 high-level security capabilities are "...intended to be the starting point for a security-centric discussion orm.

form is not intended to nor should it be used as the sole basis for medical device procurement. Writing procurement specifications requires a deeper specific elements of the users/usersusers operators) to information security (i.e., confidentiality, integrity, availability) risk specific elements of the operators information security (i.e., confidentiality, integrity, availability) device specific elements of the device-specific elements of the mmon/typical information needed by provider organizations (device users information security (i.e., confidentiality, integrity, availability) mmon/typical information needed by provider organizations (device users information security (i.e., confidentiality, integrity, availability)

HIMSS and NEMA grant permission to make copies and use this form.HIMSS and NEMA grant permission to make copies and use this form.

form is not intended to nor should it be used as the sole basis for medical device procurement. Writing procurement specifications requires a deeper

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device information security (i.e., confidentiality, integrity, availability) mmon/typical information needed by provider organizations (device information security (i.e., confidentiality, integrity, availability) information security (i.e., confidentiality, integrity, availability)

Provide a simple, flexible way of collecting the technical, information security (i.e., confidentiality, integrity, availability)

HIMSS and NEMA grant permission to make copies and use this fHIMSS and NEMA grant permission to make copies and use this f form is not intended to nor should it be used as the sole basis for medical device procurement. Writing procurement specifications requires a deeper

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device medical device

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device medical device information security (i.e., confidentiality, integrity, availability)

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device device model.

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device medical device information security (i.e., confidentiality, integrity, availability)

HIMSS and NEMA grant permission to make copies and use this fHIMSS and NEMA grant permission to make copies and use this fHIMSS and NEMA grant permission to make copies and use this f

The MDS2 form is not intended to nor should it be used as the sole basis for medical device procurement. Writing procurement specifications requires a deeper information security (i.e., confidentiality, integrity, availability) information security (i.e., confidentiality, integrity, availability) the individual device

Provide a simple, flexible way of collecting the technical, mmon/typical information needed by provider organizations (device medical device assessments

HIMSS and NEMA grant permission to make copies and use this f

PLEASE BE ADVISED

basis for medical device procurement. Writing procurement specifications requires a deeper the individual

(3) Provide a simple, flexible way of collecting the technical, common/typical information needed by provider organizations (device begin

HIMSS and NEMA grant permission to make copies and use this f

PLEASE BE ADVISED

basis for medical device procurement. Writing procurement specifications requires a deeper begin assessments

HIMSS and NEMA grant permission to make copies and use this f

Page iii

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

between vendor and purchaser or among a larger group of stakeholders involved in a Medical Device IT-Network project." Since this goal closely matches the primary objective of the MDS2 initiative, HIMSS and NEMA have undertaken an expansion and re-categorization of the MDS2 information provided by manufacturers in order to closely align with the 19 IEC/TR 80001-2-2 security categories.

HIMSS and NEMA recommend that the information in the MDS2 form be used as part of each risk assessment efforts. In the preparation of this standards publication, input of users and other interested parties has been sought and evaluated.

Inquiries, comments, and proposed or recommended revisions should be submitted to the concerned NEMA product subdivision by contacting the:

Senior Technical Director, Operations National Electrical Manufacturers Association 1300 North 17th Street, Suite 900 Rosslyn, Virginia 22209

Page iv

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

CHANGES FROM PREVIOUS (2008) MDS2 REVISION

1) Alignment of MDS2 with International Electrotechnical Commission (IEC) standard 80001-1 supplement, IEC/TR 80001-2-2, Guidance for the communication of medical device security needs, risks and controls.

a) The order and numbering of the (2008) MDS2 questions has been changed and questions are now placed in either the MANAGEMENT OF PRIVATE DATA section or under the appropriate heading in one of the 19 categories in the SECURITY CAPABILITIES section of the MDS2 form.

b) The amount of MDS2 data requested of device manufacturers has been increased to more adequately address the 19 security capabilities of IEC/TR 80001-2-2.

c) MDS2 term definitions have been added or updated to be consistent with definitions used in IEC 80001 when applicable.

All of the MDS2 security-related questions of previous MDS2 revisions remain in this latest revision with no (or only minor) changes. A cross reference of the 2008 MDS2 questions vs.

2013 MDS2 questions is provided in the Annex.

2) De-localization

Several region-specific references and standards have been removed or replaced with more generic/less region- ), defined in USA HIPAA legislation has been replaced in this MDS2 private data as defined in IEC 80001.

private data ed or replaced with more ), defined private data ed or replaced with more questions vs. questions vs.

ed or replaced with more ), defined private data revision with no (or only minor) changes. A cross reference of the 2008 MDS questions vs.

specific references and standards have been removspecific references and standards have been removed or replaced with more specific references and standards have been removspecific references and standards have been remov revision with no (or only minor) changes. A cross reference of the 2008 MDS in USA HIPAA legislation has been replaced in this MDS2 revision with no (or only minor) changes. A cross reference of the 2008 MDS specific references and standards have been removspecific references and standards have been removspecific references and standards have been remov revision with no (or only minor) changes. A cross reference of the 2008 MDS questions is provided in the Annex.

specific references and standards have been remov in USA HIPAA legislation has been replaced in this MDS revision with no (or only minor) changes. A cross reference of the 2008 MDS questions is provided in the Annex revision with no (or only minor) changes. A cross reference of the 2008 MDS questions is provided in the Annex specific references and standards have been remov questions is provided in the Annex specific references and standards have been remov revision with no (or only minor) changes. A cross reference of the 2008 MDS questions is provided in the Annex specific references and standards have been removspecific references and standards have been remov in USA HIPAA legislation has been replaced in this MDSin USA HIPAA legislation has been replaced in this MDSin USA HIPAA legislation has been replaced in this MDS as defined in IEC 80001.

specific references and standards have been removspecific references and standards have been remov revision with no (or only minor) changes. A cross reference of the 2008 MDS questions is provided in the Annex localization

Several region-specific references and standards have been remov generic/less region in USA HIPAA legislation has been replaced in this MDSin USA HIPAA legislation has been replaced in this MDS as defined in IEC 80001.

revision with no (or only minor) changes. A cross reference of the 2008 MDS

2013 MDS

2) De-localization

Several region generic/less region in USA HIPAA legislation has been replaced in this MDS as defined in IEC 80001.

Several region generic/less region in USA HIPAA legislation has been replaced in this MDS

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

Section 1

GENERAL

1.1 SCOPE

Information provided on the MDS2 form is intended to assist professionals responsible for security risk assessment processes in their management of medical device security issues. The information on the MDS2 form is not intended, and may be inappropriate, for other purposes.

1.1.1 The Role of Healthcare Providers in the Security Management Process

The provider organization has the ultimate responsibility for providing effective security management. Device manufacturers can assist providers in their security management programs by offering information describing:

t device;

h device;

any security-related features incorporated in th device.

In order to effectively manage medical information security and comply with relevant regulations, healthcare providers must employ administrative, physical, and technical safeguards most of which are extrinsic to the actual device.

1.1.2 The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on medical device security is to incorporate technical safeguards (i.e., security features) in their devices to facilitate healthcare pr efforts in maintaining effective security programs and meeting any relevant regulatory requirements and/or standards. The medical device manufacturing industry is increasingly aware of the importance of having effective security functionality in their devices. Manufacturers are generally including such security-related requirements in the production of new devices based on provider needs and requirements.

1.2 REFERENCES

The following reference documents are included herein as suggested further reading, supportive material, and related publications:

Application of risk management for IT-networks incorporating medical devices -- Part 1: Roles, responsibilities and activities, IEC 80001-1:2010

Application of risk management...-- Part 2-1: Step by Step Risk Management of Medical IT- Networks; Practical Applications and Examples, IEC 80001-2-1:2012

Application of risk management...-- Part 2-2: Guidance for the communication of medical device security needs, risks and controls, IEC/TR 80001-2-2:2012

Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191 (USA)

Health Insurance Reform: Security Standards; Final Rule, 45 CFR pts.160, 162, 164 (USA, 2003).

EC Data Protection Directive, 95/46/EC (EU 95/46), 1995.

Act on the Protection of Personal Information (Act No. 57 of 2003, Japan).

to facilitate healthcare pr efforts in maintaining effective security programs and meeting any relevant regulatory requirements manufacturing industry is increasingly aware of the . Manufacturers are generally

The Role of Medical Device Manufacturers in the Security Management Process

In order to effectively manage medical information security and comply with relevant regulations, technical safeguardstechnical safeguardstechnical safeguards most of

In order to effectively manage medical information security and comply with relevant regulations, The Role of Medical Device Manufacturers in the Security Management Process security is to incorporate

In order to effectively manage medical information security and comply with relevant regulations, technical safeguardstechnical safeguards

The Role of Medical Device Manufacturers in the Security Management Process security is to incorporate

In order to effectively manage medical information security and comply with relevant regulations, technical safeguards medical device security is to incorporate devices to facilitate healthcare pr efforts in maintaining effective security programs and meeting any relevant regulatory requirements manufacturing industry is increasingly aware of the heir devices

In order to effectively manage medical information security and comply with relevant regulations, physical, and , and

The Role of Medical Device Manufacturers in the Security Management ProcessThe Role of Medical Device Manufacturers in the Security Management Process

In order to effectively manage medical information security and comply with relevant regulations, administrative, physical

The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on medical deviceThe greatest impact manufacturers can have on medical device (i.e., security features) in their devices efforts in maintaining effective security programs and meeting any relevant regulatory requirements manufacturing industry is increasingly aware of the importance of having effective security functionality in t

In order to effectively manage medical information security and comply with relevant regulations, administrative

In order to effectively manage medical information security and comply with relevant regulations, administrative device

The Role of Medical Device Manufacturers in the Security Management Process administrative device.

The Role of Medical Device Manufacturers in the Security Management Process

In order to effectively manage medical information security and comply with relevant regulations, healthcare providers must employ administrative which are extrinsic to the actual device

The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on The greatest impact manufacturers can have on The greatest impact manufacturers can have on (i.e., security features) in their (i.e., security features) in their efforts in maintaining effective security programs and meeting any relevant regulatory requirements medical device manufacturing industry is increasingly aware of the importance of having effective security functionality in t

The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on

The Role of Medical Device Manufacturers in the Security Management Process

In order to effectively manage medical information security and comply with relevant regulations, healthcare providers must employ which are extrinsic to the actual

The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on The greatest impact manufacturers can have on technical safeguards efforts in maintaining effective security programs and meeting any relevant regulatory requirements and/or standards. The importance of having effective security functionality in t

In order to effectively manage medical information security and comply with relevant regulations, healthcare providers must employ which are extrinsic to the actual

1.1.2 The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on technical safeguards efforts in maintaining effective security programs and meeting any relevant regulatory requirements and/or standards. The importance of having effective security functionality in t

The Role of Medical Device Manufacturers in the Security Management Process

The greatest impact manufacturers can have on technical safeguards

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

Personal Information Protection and Electronic Documents Act (PIPEDA), Statutes of Canada, 2000.

Guide for Information Security for Biomedical Technology: A HIPAA Compliance Guide, May 2004, American College of Clinical Engineering (ACCE)/ECRI.

1.3 DEFINITIONS

administrative safeguards: Administrative actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect private data information.

anti-malware: See anti-virus software.

anti-virus software: A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. See also virus scanner.

audit trail: Data collected and potentially used to facilitate a security audit.

biometric data: Identifies a human via a measurement of a physical feature or repeatable action of the individual (e.g., hand geometry, retinal scan, iris scan, fingerprint patterns, facial characteristics, DNA sequence characteristics, voice prints, handwritten signature).

device: A product/system, including hardware, firmware and/or (only) software, etc. Unless otherwise clear from the context, in this MDS2 device medical device

2 form.

See also medical device.

electronic media: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange information already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, and private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper via facsimile and of voice via telephone, are not considered to be transmissions via electronic media because the information being exchanged did not exist in electronic form before the transmission.

electronic protected health information (ePHI): (As defined in U.S. HIPAA legislation, 45 CFR 160.103) individually identifiable health information (IIHI) that is (1) transmitted by or (2) maintained in electronic media.

emergency access: The process or mechanism by which a device user can quickly and easily access private data controls.

individually identifiable health information (IIHI): Information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

intended use: Use for which a product, process or service is intended according to the specifications, instructions and information provided by the manufacturer. (source: ISO 14971:

2007, Application of risk management to medical devices, definition 2.5).

optical disks, or digital memory cards. (2) Transmission media used to exchange information already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating ks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper via

: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, : (1) Electronic storage media, including memory devices in computers (hard medical device 2 form.

medical device

: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange information medical device

: (1) Electronic storage media, including memory devices in computers (hard : (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange infor drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange inforoptical disks, or digital memory cards. (2) Transmission media used to exchange infor already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating ks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper via device

: (1) Electronic storage media, including memory devices in computers (hard : (1) Electronic storage media, including memory devices in computers (hard : (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, device

: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange inforoptical disks, or digital memory cards. (2) Transmission media used to exchange infor already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating up lines, and private networ removable/transportable electronic storage media. Certain transmissions, including of paper via otherwise clear from the context, in this MDS

: (1) Electronic storage media, including memory devices in computers (hard : (1) Electronic storage media, including memory devices in computers (hard otherwise clear from the context, in this MDS2

: (1) Electronic storage media, including memory devices in computers (hard : (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange infor drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange inforoptical disks, or digital memory cards. (2) Transmission media used to exchange infor already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, and private networ removable/transportable electronic storage media. Certain transmissions, including of paper via

: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, : (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, otherwise clear from the context, in this MDS medical device electronic media: (1) Electronic storage media, including memory devices in computers (hard drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange inforoptical disks, or digital memory cards. (2) Transmission media used to exchange infor already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating parties), leased lines, dial removable/transportable electronic storage media. Certain transmissions, including of paper via otherwise clear from the context, in this MDS

See also medical device electronic media drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange infor already in electronic storage media, including, for example, the Internet (wide open), extranet (using Internet technology to link a business with information accessible only to collaborating parties), leased lines, dial removable/transportable electronic storage media. Certain transmissions, including of paper via electronic media drives) and any removable/transportable digital memory media, such as magnetic tapes or disks, optical disks, or digital memory cards. (2) Transmission media used to exchange infor

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

malware: Malicious software. A software program that is inserted into a system, usually covertly, applications, or operating system or of otherwise annoying or disrupting the victim. (source: NIST SP 800-83, Guide to Malware Incident Prevention and Handling) medical device: Any instrument, apparatus, implement, machine, appliance, implant, in vitro reagent or calibrator, software, material or other similar or related article:

a) intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the specific purpose(s) of:

diagnosis, prevention, monitoring, treatment or alleviation of disease, diagnosis, monitoring, treatment, alleviation of or compensation for an injury, investigation, replacement, modification, or support of the anatomy or of a physiological process, supporting or sustaining life, control of conception, disinfection of medical devices, providing information for medical or diagnostic purposes by means of in vitro examination of specimens derived from the human body;

b) which does not achieve its primary intended action in or on the human body by pharmacological, immunological or metabolic means, but which may be assisted in its intended function by such means.

operator: Person handling equipment. The person(s) using a medical device for its intended purpose.

personal identification number (PIN): A number or code assigned to an individual and used to provide verification of identity.

physical safeguards: The physical measures, policies, and procedures to protect an environmental hazards and unauthorized intrusion.

private data: Any information relating to an identified or identifiable person.

process: A set of inter-related or interacting activities which transforms inputs into outputs.

remote service: A support service (e.g., testing, diagnostics, software upgrades) while not physically or directly connected to the device (e.g., remote access via modem, network, Internet).

removable media: Electronic media that can be removed from a system without the use of tools.

risk assessment: Conducting an accurate and thorough analysis of the potential risks and vulnerabilities to the integrity, availability, and confidentiality of private data.

risk management: (1) The ongoing process of assessing risk, taking steps to reduce risk to an acceptable level, and maintaining that level of risk. (2) Security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

security capability: The broad category of technical, administrative or organizational controls to manage risks of confidentiality, integrity, and availability and accountability of data and systems.

technical safeguards: The technology, policies, and procedures to protect data, including private data and control access to it.

token: A physical authentication device that the user carries (e.g., smartcard, SecureIDtm, etc.).

Often combined with a PIN to provide a two-factor authentication method that is generally thought of as superior to simple password authentication.

user: See operator.

virus: See malware.

: Any information relating to an identified or identifiable person.

related or interacting activities which transforms inputs into outputs.

cs, software upgrades) while not physically or directly connected to the device (e.g., remote access via modem, network, Internet).

: The physical measures, policies, and procedures to protect an d used to

: The physical measures, policies, and procedures to protect an d used to A number or code assigned to an individual an

: The physical measures, policies, and procedures to protect an : The physical measures, policies, and procedures to protect an

: Any information relating to an identified or identifiable person.

A number or code assigned to an individual an

: Any information relating to an identified or identifiable person.: Any information relating to an identified or identifiable person.

related or interacting activities which transforms inputs into outputs.

: A support service (e.g., testing, diagnostics, software upgrades) while not physically or directly connected to the device (e.g., remote access via modem, network, Internet).

A number or code assigned to an individual an

: The physical measures, policies, and procedures to protect an : The physical measures, policies, and procedures to protect an : The physical measures, policies, and procedures to protect an uthorized intrusion.

A number or code assigned to an individual an uthorized intrusion.

: Any information relating to an identified or identifiable person.: Any information relating to an identified or identifiable person.

related or interacting activities which transforms inputs into outputs.

: A support service (e.g., testing, diagnosti physically or directly connected to the device (e.g., remote access via modem, network, Internet).

A number or code assigned to an individual anA number or code assigned to an individual an

: The physical measures, policies, and procedures to protect an : The physical measures, policies, and procedures to protect an environmental hazards and una

: The physical measures, policies, and procedures to protect an personal identification number (PIN): A number or code assigned to an individual an provide verification of identity.

: The physical measures, policies, and procedures to protect an uthorized intrusion.uthorized intrusion.

: Any information relating to an identified or identifiable person.: Any information relating to an identified or identifiable person.: Any information relating to an identified or identifiable person.

related or interacting activities which transforms inputs into outputs.

: A support service (e.g., testing, diagnosti physically or directly connected to the device (e.g., remote access via modem, network, Internet).

environmental hazards and unauthorized intrusion.environmental hazards and una personal identification number (PIN) provide verification of identity.

physical safeguards: The physical measures, policies, and procedures to protect an environmental hazards and una private data: Any information relating to an identified or identifiable person.

process: A set of inter remote service: A support service (e.g., testing, diagnosti physically or directly connected to the device (e.g., remote access via modem, network, Internet).

personal identification number (PIN) provide verification of identity.

physical safeguards environmental hazards and una private data process remote service physically or directly connected to the device (e.g., remote access via modem, network, Internet).

environmental hazards and una private data

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

virus scanner: A computer program (anti-virus software) that detects a viruscomputer program, or other kind of malware (e.g., worms and Trojan horses), warns of its presence, and attempts to prevent it from affecting the protected computer. Malware often results in undesired side effects generally unanticipated by the user.

vulnerability: A flaw or weakness in device procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the device

1.4 ACRONYMS

CD Compact Disk

CF Compact Flash

COTS Commercial Off-The-Shelf

DVD Digital Versatile Disk

IP Internet Protocol

LAN Local Area Network

OS Operating System

ROM Read Only Memory

SD Secure Digital

USB Universal Serial Bus

VPN Virtual Private Network

WAN Wide Area Network

WiFi Wireless Fidelity

Virtual Private Network Virtual Private Network

Universal Serial Bus

Virtual Private Network

Wide Area Network

Wireless Fidelity

Wide Area Network

Virtual Private Network

Secure Digital

Universal Serial Bus

Virtual Private Network

Wide Area Network

Wireless Fidelity

SD Secure Digital

USB Universal Serial Bus

VPN Virtual Private Network

WAN

WiFi

Virtual Private Network

Wide Area Network

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

Section 2

INSTRUCTIONS FOR OBTAINING, USING, AND COMPLETING MDS2 FORM

2.1 OBTAINING THE MDS2 FORM (PROVIDERS)

Completed MDS2 forms for many devices may be available directly from the device manufacturer (e.g., manufacturer website).

NOTE If a manufacturer does not have a completed MDS2 form for the appropriate device(s), enter manufacturer and model information in the appropriate boxes on the top of a blank MDS2 form, and submit the form(s) and these instructions

2.2 USING THE MDS2 FORM (PROVIDERS)

2.2.1 Device Description

The first two sections of the MDS2 form are used to identify the device (DEVICE DESCRIPTION) and describe the type of data maintained/transmitted by the device and how the data is maintained/transmitted, etc. (MANAGEMENT OF PRIVATE DATA).

PLEASE BE ADVISED any listed function (i.e., manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and permission. Unless otherwise indicated, the questions contained on the MDS2 form generally refer to device capability.

Permission is typically a contractual matter separate from the MDS2 form. Making changes to a medical device without explicit manufacturer authorization may have significant contractual, safety and liability issues.

2.2.2 Explanatory Notes

The MDS2 form contains space for explanatory notes if the manufacturer needs to explain specific details of

NOTE Manufacturers may elect to attach supplementary material if additional space for recommended practices or explanatory notes is necessary.

2.2.3 Security Capabilities

The final section of the MDS2 (SECURITY CAPABILITIES) contains information on the specific security-related capabilities of the device. The information is organized into categories aligned with IEC 80001-2-2, Guidance for the communication of medical device security needs, risks, and controls.

2.3 COMPLETING THE MDS2 FORM (MANUFACTURERS)

2.3.1 General

The manufacturer shall provide the information requested in the MDS2 form to the appropriate requesting organization, including all requested descriptive information on the type of data maintained/transmitted by the device, how the data is maintained/transmitted, and other security-related features incorporated in the device, as appropriate.

2.3.2 MDS2 Form Completion Guidance

DEVICE DESCRIPTION section:

form contains space for explanatory notes if the manufacturer needs to explain specific form generally refer to device capability.

form. Making changes r authorization may have significant manufacturer to configure the device or cause the device to perform those listed functions.

permission. Unless otherwise form generally refer to device capability.

manufacturer to configure the device or cause the device to perform those listed functions.

r authorization may have significant manufacturer to configure the device or cause the device to perform those listed functions.

permission. Unless otherwise permission. Unless otherwise form generally refer to device capability.

Permission is typically a contractual matter separate from the MDS2 form generally refer to device capability. form generally refer to device capability. form generally refer to device capability.

Permission is typically a contractual matter separate from the MDS2 form. Making changes r authorization may have significant r authorization may have significant manufacturer to configure the device or cause the device to perform those listed functions.

r authorization may have significant form contains space for explanatory notes if the manufacturer needs to explain specific manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and permission. Unless otherwise indicated, the questions contained on the MDS2 permission. Unless otherwise indicated, the questions contained on the MDS form generally refer to device capability.

Permission is typically a contractual matter separate from the MDS form generally refer to device capability.

Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture Permission is typically a contractual matter separate from the MDS r authorization may have significant manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and to a medical device without explicit manufacturer authorization may have significant form contains space for explanatory notes if the manufacturer needs to explain specific manufacturer to configure the device or cause the device to perform those listed functions.manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and indicated, the questions contained on the MDS Permission is typically a contractual matter separate from the MDS

It is important to distinguish between capability and indicated, the questions contained on the MDS Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture indicated, the questions contained on the MDS manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and indicated, the questions contained on the MDS Permission is typically a contractual matter separate from the MDSPermission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture contractual, safety and liability issues.

to a medical device without explicit manufacture contractual, safety and liability issues. contractual, safety and liability issues.

otes form contains space for explanatory notes if the manufacturer needs to explain specific

Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture contractual, safety and liability issues.

Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and indicated, the questions contained on the MDS Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture contractual, safety and liability issues. contractual, safety and liability issues.

Explanatory N

The MDS2 form contains space for explanatory notes if the manufacturer needs to explain specific of manufacturer to configure the device or cause the device to perform those listed functions.

It is important to distinguish between capability and indicated, the questions contained on the MDS Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture contractual, safety and liability issues.

2.2.2

The MDS details

Permission is typically a contractual matter separate from the MDS to a medical device without explicit manufacture contractual, safety and liability issues.

© Copyright 2013 by the National Electrical Manufacturers Association and the Healthcare Information and Management Systems Society.

Device Category: This is a free-text field. The manufacturer should use standard terminology that customers would reasonably understand to differentiate key modalities or device functionality.

Device Model: This is a free-text field. The manufacturer should fill in the name of the device under which it is placed on the market.

Document ID: The document ID is the manu device documentation.

Manufacturer Contact Information: This information identifies how the person or department accountable for the final version of the form can be contacted.

Intended use of device in network-connected environment: This allows the manufacturer to describe the intended function and use of the device and, if relevant, how the device is expected to be used if connected to a cu

MANAGEMENT OF PRIVATE DATA section:

If additional information is needed for proper interpretation of an…