Draft a Manufacturer Disclosure Statement for Medical Device Security using the 23 sections of ANSI/NEMA HN 1-2019. Use it to prepare your answers, then transfer them to the official NEMA MDS2 form your customers expect.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
HN 1-2019 sections
0 / 23 answered (0%)Management of Private Data (MPII)
What personal or health data the device stores, displays, or transmits, and where.
Automatic Logoff (ALOF)
Inactivity timeout or screen lock for user sessions.
Audit Controls (AUDT)
Logging of security-relevant events, such as logins, configuration changes, and data exports.
Authorization (AUTH)
Role and permission model that limits what each user can do.
Cybersecurity Product Upgrades (CSUP)
How security patches and updates reach the device, who installs them, and how quickly.
Health Data De-Identification (DIDT)
Built-in ability to remove identifying information from exports, logs, or service data.
Data Backup and Disaster Recovery (DTBK)
Backup, restore, and recovery of data and configuration.
Emergency Access (EMRG)
Break-glass access in an emergency, with logging and review.
Health Data Integrity and Authenticity (IGAU)
How the device makes sure stored health data is not changed or deleted without authorization.
Malware Detection/Protection (MLDP)
Antivirus, allowlisting, or platform protections, and who maintains them.
Node Authentication (NAUT)
How the device and the systems it talks to verify each other.
Connectivity Capabilities (CONN)
Network, wireless, and removable-media interfaces, ports, and protocols.
Person Authentication (PAUT)
How users prove who they are: accounts, passwords, badges, or single sign-on.
Physical Locks (PLOK)
Physical protection of components and removable media.
Roadmap for Third Party Components in Device Life Cycle (RDMP)
Plans for supporting, updating, or replacing third-party software over the device's life.
Software Bill of Materials (SBOM)
Whether an SBOM is available and what it lists.
System and Application Hardening (SAHD)
Removed or disabled unused services, accounts, and defaults.
Security Guidance (SGUD)
Security documentation for customers: configuration, operation, and end-of-life steps.
Health Data Storage Confidentiality (STCF)
Encryption or other protection of stored health data and credentials.
Transmission Confidentiality (TXCF)
Encryption of health data in transit.
Transmission Integrity (TXIG)
Protection against changes to data in transit.
Remote Service (RMOT)
Remote access for service or support: who connects, how, and with whose approval.
Other Security Considerations (OTHR)
Anything security-relevant the other sections do not cover.
What you'll see after you submit
Common misconceptions
Myth: MDS² is an FDA submission document.
Reality: MDS² is a customer-facing disclosure for hospitals and IDNs. The FDA recognizes ANSI/NEMA HN 1-2019 as a consensus standard, but neither the FDA guidance nor eSTAR requires an MDS² in a submission.
Myth: A blank or all-N/A MDS² satisfies procurement.
Reality: Hospital security teams read each answer and follow up on gaps. Unexplained N/A answers slow security review and contracting.
Myth: Once published, MDS² stays static.
Reality: MDS² is versioned with the device. Any change to authentication, encryption, OTA, or supported OS triggers a refresh.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
Check your submission documents before you finalize the MDS².
Read eSTAR Cybersecurity ChecklistRequired §524B disclosure policy your MDS² should reference.
Read CVD Policy GeneratorThe MDS² SBOM section asks whether an SBOM is available.
Read SBOM Readiness CheckerFull SPDF and submission support, with MDS² drafting.
Read FDA premarket cybersecurity services