MedTech Terms
    The authoritative reference
    All terms

    Manufacturer Disclosure Statement for Medical Device Security

    A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    The Manufacturer Disclosure Statement for Medical Device Security (MDS2), maintained by the Healthcare Information and Management Systems Society (HIMSS) and aligned to IEC 80001-2-2, is a standardized questionnaire that manufacturers complete to disclose a connected device's security characteristics - authentication, encryption, audit controls, malware protection, network configuration, patch policy - to hospital procurement and security teams.
    What the regulation says
    FDA's 2023 guidance expects manufacturers to provide security disclosure to operators; MDS2 is the de-facto industry-standard format. MDS2 is referenced in HSCC and AHA guidance and frequently required by hospital procurement contracts.

    What this means in practice

    MDS2 sits at the manufacturer-HDO handoff and is one of the highest-leverage documents a security program produces. A well-completed, current MDS2 directly accelerates hospital procurement; a stale or incomplete MDS2 stalls deals. Mature MedTech teams maintain MDS2 as a living document tied to each release.
    Common pitfalls
    • •Treating MDS2 as a marketing document - overstating capabilities backfires in operator audits.
    • •Letting MDS2 go stale across releases.
    • •Not aligning MDS2 to MDS2-2019 (the current version) - older versions miss key security characteristics.

    Frequently asked questions

    Not by name, but the cybersecurity labeling and operator-disclosure expectations in the 2023 guidance are routinely satisfied via MDS2.

    Cross-references

    See also

    Closely related context worth reading.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    HIMSS·1ISO/IEC·1HSCC·1
    1. 1
      HIMSS MDS2
      Bot-blocked
      HIMSShimss.org
    2. 2
      IEC TR 80001-2-2
      Verified
      ISO/IECiso.org
    3. 3
      HSCC - Health Sector Coordinating Council
      Verified
      HSCChealthsectorcouncil.org

    Inline markers like [1] jump to the matching reference above.