Introduction

Healthcare clinics looking to acquire biomedical devices can expedite the acquisition and implementation of their technology by preparing in advance some of the required information for University Information Services to complete a security review and assessment.

Because of the time involved with assessment and implementation of these devices in partnership with the requesting department, the documentation outlined below should be included in a UIS Project Request submission

Vendor Documentation

-Manufacturer Disclosure Statement for Medical Device Security aka MDS2
-Higher Education Cloud Vendor Assessment Tool Lite Edition
-Miscellaneous Documentation

Manufacturer Disclosure Statement for Medical Device Security or "MDS2"

The MDS2 Worksheet can be downloaded, along with an example worksheet, from the National Electrical Manufacturers Association webpage. In many cases, your vendor may have already completed this document for other prospective customers and enhanced instructions for completing the form are available on the above webpage free of charge.

The document, when completed, provides a high level account for how personally identifiable information is managed, protected, how access is authorized and audited, malware protected, and more.

In virtually all cases, this document is required. Please include the vendor-completed document with your Project Request.

Higher Education Cloud Vendor Assessment Tool (Lite Edition)

This is a required evaluation tool only when the biomedical device or instrument interfaces with an internet facing service.  HECVAT, the most current version of this questionnaire framework can be obtained from this educause webpage free of charge. Over a hundred colleges and universities now leverage this tool to assess cloud services.

Please include the vendor-completed document with your Project Request.

Miscellaneous Documentation

Please include in your project request any of the documents listed below. All these documents will help guide us in a successful integration with existing technology, and more swiftly produce a written evaluation of the technology.

• User Guides
• Administrator Guides
• Network Diagrams
• Any other technical documentation