Hospital reviewers ask a small set of questions about third party code. Answer each with a plain statement of what you do, the evidence you can show and the date it was true. Avoid absolutes like "no vulnerabilities." The patterns below are starting points, so edit them until every word is true for you.
The eight questions
| Question | Answer pattern | Evidence |
|---|---|---|
| Do you use open source? | Yes, with inventory, scanning and review before adoption | Sample inventory, policy |
| How do you track third party components? | Per release inventory generated at build | SBOM extract |
| How do you learn of new vulnerabilities? | Automated matching of inventory to advisories, plus a human review | Tool output, runbook |
| How fast do you fix them? | Tiered by severity and exploitability, measured | Policy, sample tickets |
| Do you use end of life components? | Disclose honestly, with plan | Risk acceptance record |
| Which outside services can receive patient data? | A named list with agreement status | Service table |
| How do you vet new dependencies? | Checklist before adoption, named reviewer | Checklist, past approvals |
| How will we hear about issues affecting us? | Advisory process with named contact | Runbook, template |
Writing each answer
Start with the verb. "We scan" beats "scanning is performed." Say the frequency. Name the role, not the person. Offer evidence in one clause and stop.
Reviewers compare answers across questions. If you say you scan on every build in one place and monthly in another, the inconsistency costs more than either answer. Keep a short answer library with owners and review dates, and reuse the same sentences.
What a reviewer checks behind the scenes
Under the HIPAA Security Rule, covered entities must obtain satisfactory assurances that a business associate will appropriately safeguard electronic protected health information (45 CFR 164.308(b)(1)), and business associate contracts must provide for reporting of security incidents and for subcontractors to agree to the applicable requirements (164.314(a)(2)). Your answers are the evidence they use to meet that duty on their side. Treat each answer as something they may file.
Common traps
- Answering "yes" to a compound question when only half is true.
- Linking to a public page that says something different from your answer.
- Promising continuous monitoring when you have a monthly scan.
- Leaving a question blank. A short "not today, planned by this date" is better.
Review before sending
- Another person reads every answer and checks it against evidence.
- Dates are current.
- Anything legal or contractual is flagged for counsel.
- Copies are stored so later answers stay consistent.
Try it yourself
Click through it at your own pace, or open it full screen. See how one piece of evidence can map to several control requirements, which is the idea behind a reusable answer library.
Safeguard offers compliance and evidence automation that keeps dated records for answers like these, and a free scan at gold.safeguard.sh/scan shows your inventory.
Quick check
What if we cannot answer a question yet?
Say so, give a date, and describe the interim control if there is one. Never guess.
Should every hospital get identical answers?
Core answers yes. Customize only where a contract or deployment model really differs.
Sources
Last reviewed: 19 October 2026.
