Where the operator’s duty touches information security
The Medical Devices Operator Ordinance was revised on 20 February 2025; its sections are renumbered, and Section 17 on the IT security review of certain software has applied since 1 August 2025. The module is deliberately not a medical technology system. It starts where the operator’s duty touches information security: the IT security review under Section 17, networked devices with network segment and vulnerabilities, and evidence towards the B3S for medical care. In most hospitals the inventory already lives in opti.MED, waveware, Hectec or S+P Samson. So every site declares once whether isidaten leads or mirrors.
In mirror mode the imported master data is read-only on every write path, including bulk edit, API and console. A manual change would vanish at the next import, and that is exactly where mirror operations lose trust. Only what the leading system does not know is maintained locally.
Software of classes IIb and III and IVD C and D requires the IT security review under Section 17. The module flags these products, links them to the IT system, the network designation and the support end, and turns the duty into an auditable inventory rather than a footnote in the device log.
The import profiles for the third-party systems are based on descriptions of the export formats and are sharpened with the first real export. So the assistant does not discard unknown columns but shows them after the run.
The operator’s duty and the information security of the same devices in one inventory, without keeping the medical technology system a second time.
Schedule a no-obligation demo – we will show you the module with your own use cases.
