QuoteVitalsHow to compare vendors' MDS2 security forms
The MDS2, the Manufacturer Disclosure Statement for Medical Device Security, is the standard form a device manufacturer fills in to describe a product's security capabilities: what data it stores, how users sign in, whether data is encrypted, how it is patched, and how the vendor connects for remote service. Hospitals commonly ask every vendor for one during a purchase, and the IT security team then has to compare forms that run to many pages each. This guide covers how to read them side by side.
Check which version you received
Two versions are in common use. The 2019 version reorganized the questions, gave each one an identifier, and added topics, including a software bill of materials. The 2013 version is still sent for older products. Answers from the two do not line up question for question, so map them to one structure before comparing, and treat an outdated form as a finding in itself: ask the vendor whether a current form exists.
Check that the form matches what is being quoted
The form describes a specific model and software version. Confirm that it is the model on the quote and a current software release. A form for a different model, or for a software version two releases old, does not describe what you are buying.
Read the answers, then the notes
- "No" answers on the questions your organization treats as requirements are the first list for IT security.
- "N/A" answers deserve a second look. N/A is correct when a capability truly does not apply; a long run of N/A on questions that plainly do apply usually means the form was not completed with care.
- Notes are where vendors qualify a "Yes". An empty or vague note on an important question is worth a follow-up.
- Data storage: if the device stores data permanently, the form should say how it is removed at end of life or before service.
Compare the same questions across vendors
Put the vendors in columns and the questions in rows, and highlight where the answers differ. A difference is not automatically a reason to choose one vendor over another, but each one should be explained before the committee meets. A vendor that does not send a form at all, or declines to, is itself a finding.
What the form is and is not
The MDS2 is the manufacturer's own disclosure. It describes what the product is designed to support; it does not show how a unit will be configured on your network. Your IT security team still decides what is acceptable, and the configuration checks happen at installation.
In QuoteVitals. QuoteVitals reads the MDS2 forms on the same capital request as the quotes, lines the vendors up side by side, and flags outdated forms, mismatched versions, runs of N/A and empty notes for your IT security team. It compares what each vendor disclosed; it does not verify configuration. See it on the worked example (no sign-up), or start a free trial: 30 days, a worked sample plus one capital request of your own, no card.