Answer yes, because nearly every modern product does. Then say how you manage it: you keep an inventory of direct and transitive components, scan it on a schedule, set update timelines by severity, and can name an owner. A hospital reviewer is checking for control, not for zero open source.
What the reviewer is really asking
The question sounds like a license question, but in a hospital review it is a risk question. The reviewer wants to know whether you can find out quickly when a library in your product has a serious flaw, and whether you will tell them. A "no" is usually read as "we do not know," which is worse than a yes with a process behind it.
The HIPAA Security Rule asks covered entities and business associates to assess risks and vulnerabilities to electronic protected health information and to implement measures that reduce them to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)). Open source components are part of that picture, so your answer should connect to a real risk process.
A four part answer that holds up
| Part | What to say | Evidence to offer |
|---|---|---|
| Inventory | We keep a list of direct and transitive components per release | Sample SBOM or inventory export |
| Scanning | We scan on every build and re-check released versions regularly | Scan schedule, last run date |
| Response | We set fix timelines by severity and exploitability | Written policy, sample ticket |
| Ownership | A named role reviews new components before adoption | Approval record or checklist |
Keep each cell true today. If you scan on a schedule but not on every build, say that. A precise, modest answer survives a follow up call. An inflated one does not.
Steps to prepare the answer
- Generate a current inventory for your main release, including transitive dependencies.
- Write down how often scanning runs and who sees the results.
- Pick the severity and timeline wording from your actual policy, not from a template.
- Decide what you will share before a call: a summary, an SBOM under NDA, or both.
- Note one recent example where a component was updated because of an advisory.
Wording you can adapt
"Yes. Our application uses open source components. We maintain a component inventory for each release, scan it for known vulnerabilities, and review new components before adoption. High severity issues that are exploitable in our product are handled under our remediation policy, and we can share a component list under NDA."
Avoid absolute phrases such as "no known vulnerabilities" or "fully patched." They are impossible to prove and reviewers know it. A statement about process and dates is safer.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how direct and transitive packages are listed together, because that is the shape of inventory a reviewer expects.
If you want a starting inventory, Safeguard offers SBOM and dependency scanning with reachability analysis, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Is it a problem to say we use open source?
No. Reviewers expect it. The problem is saying you use it without describing how you track and update it.
Do we have to hand over our full component list?
Not necessarily. Many vendors share a summary first and the full list under NDA. Check your contract and ask your counsel if you are unsure.
Sources
Last reviewed: 19 October 2026.
