A good packet has six items: a component inventory, a scanning and update policy, a recent scan summary, an incident and advisory process, a hosted service list, and a named owner. Prepare it once, keep it dated, and reuse it across hospitals instead of rewriting answers for every questionnaire.
Why a packet beats ad hoc answers
Hospital reviews repeat. Different questionnaires ask the same five questions in different words. A packet lets your team answer from one source of truth and keeps answers consistent between reviews, which matters because inconsistent answers are one of the quickest ways to lose reviewer confidence.
The six items
| Item | What it is | Format | Update rhythm |
|---|---|---|---|
| Component inventory | Direct and transitive components of the current release | SBOM export or summary table | Each release |
| Dependency policy | How you adopt, scan, update and retire components | One to two pages | Annually and on change |
| Scan summary | Last run date, scope, counts by severity, how you handled criticals | One page, no raw exports | Monthly or per release |
| Advisory process | How you learn of issues, assess, fix, and notify customers | Short runbook | Annually |
| Hosted service list | Outside services that can receive ePHI and the agreement status | Table | Quarterly |
| Ownership | Role names for each area, escalation path | Table | On staffing change |
Practical rules for each item
Inventory: share a summary by default and the full list under NDA. CISA describes an SBOM as a nested inventory of the components that make up software, and notes that a VEX document is an attestation indicating whether products are affected by known vulnerabilities. Offering both when asked shows maturity.
Scan summary: give the date, scope and what you did about critical findings. Avoid raw exports, which invite line by line questions without context.
Advisory process: state how fast you triage and how customers hear about it. Do not promise a number you cannot meet.
Hosted service list: be exact about which services can receive ePHI. The Security Rule expects business associates to ensure subcontractors that handle ePHI agree to comply with the applicable requirements.
Steps to assemble it in a week
- Day 1: export the inventory for your main release and draft the hosted service list.
- Day 2: write the dependency policy from what you really do.
- Day 3: run a fresh scan and write the one page summary.
- Day 4: write the advisory runbook and pick owners.
- Day 5: have someone outside engineering read it and ask what is unclear.
Keep it honest
Every sentence should be something you could show evidence for tomorrow. If the scan runs monthly, do not write "continuous." If a gap exists, add a dated plan. Reviewers are more forgiving of a stated gap with a plan than of an answer that falls apart on a follow up call.
Safeguard can generate the inventory and scan summary from one place, and its compliance and evidence automation keeps dated records, though the packet's wording is yours to write. A free scan is available at gold.safeguard.sh/scan.
Quick check
Should we send the packet before the hospital asks?
Often yes, once a deal reaches security review. Sending it early shortens back and forth. Mark it confidential and send it under NDA where your policy requires.
How long should the packet be?
Short. Six to ten pages total is usually enough. Attach deeper material only on request.
Sources
Last reviewed: 19 October 2026.
