# CareFusion (BD)

> CareFusion is a medical technology brand acquired by BD (Becton, Dickinson and Company)
> in 2015, best known for the Alaris infusion system and the Pyxis automated dispensing
> line. CareFusion publishes NO public developer API, NO OpenAPI/AsyncAPI/GraphQL/WSDL
> contract, NO SDK and NO developer portal. Its products interoperate with hospital EMR and
> pharmacy systems over HL7 v2 interfaces that BD interface-engineering teams configure per
> site under a customer contract.

Provenance: GENERATED by the API Evangelist enrichment pipeline on 2026-09-06 from
all/carefusion/apis.yml and the artifacts in this repository. It is NOT a CareFusion- or
BD-published document. BD does serve its own llms.txt at https://www.bd.com/llms.txt
(HTTP 200, text/plain, last updated 2026-03-18), but its stated subject is
"Becton, Dickinson and Company" corporate-wide, not the CareFusion brand, so it is recorded
here as an observation rather than copied in and claimed for this record.

## What exists

- Alaris Infusion Interoperability — EMR-to-pump order transmission for BD Alaris
  large-volume, syringe and PCA modules, with infusion status returned to the EMR and the
  Alaris Guardrails drug library as the clinical decision-support layer. Product page:
  https://www.bd.com/en-us/products-and-solutions/products/product-families/bd-alaris-emr-interoperability
- Pyxis Automated Dispensing Integration — BD Pyxis ES cabinets synchronised with pharmacy
  information systems and EMRs over HL7 v2 (ADT, ORM, RDE, RDS) message families.
  Brand page: https://www.bd.com/en-us/products-and-solutions/products/product-brands/pyxis

## What does NOT exist (measured, not assumed)

- No OpenAPI or Swagger. https://www.bd.com/openapi.json and /swagger.json both return 404
  to a browser-class request.
- No developer portal, API reference, getting-started guide, sandbox, CLI, SDK, Postman
  collection, MCP server or A2A agent card. The bd.com/en-us sitemap holds 1,382 URLs and
  none of them is a developer or API page; none of them contains the string "carefusion".
- No /.well-known/ document on any bd.com or carefusion.com host. See
  well-known/carefusion-well-known.yml for the full per-host probe record.
- No published plans, pricing or rate limits. Commercial terms are quoted per hospital.
- No first-party package in npm, PyPI, RubyGems or crates.io. github.com/CareFusion is an
  empty organisation with zero public repositories and no attribution to BD.

## Where the integration surface actually lives

The HL7 v2 interface specification for Alaris and Pyxis is delivered to contracted customers,
not published. The surviving CareFusion-domain surface is a login-only portal:
https://rsscp.carefusion.com/ ("BD - RSS Customer Portal"), an AngularJS single-page
application that answers HTTP 200 with the same 1,940-byte shell for every path.

## Security, trust and lifecycle (these ARE public)

- BD Cybersecurity Trust Center: https://www.bd.com/en-us/about-bd/cybersecurity
- Coordinated vulnerability disclosure process: https://www.bd.com/en-us/about-bd/cybersecurity?active-tab=3
- BD Alaris security patches: https://www.bd.com/en-us/about-bd/cybersecurity/patches/security-patches-bd-alaris-products
- BD Pyxis security patches: https://www.bd.com/en-us/about-bd/cybersecurity/patches/security-patches-bd-pyxis-products
- Published certifications: ISO/IEC 27001:2022 (entity-scoped), UL 2900-2-1 (BD Synapsys),
  SOC 2+ and MDS2 (both asserted, reports request-only). BD is a CVE Numbering Authority.

## Company and legal

- Website: https://www.bd.com/
- Support: https://www.bd.com/en-us/support
- Contact: https://www.bd.com/en-us/support/contact-us
- Terms of use: https://www.bd.com/en-us/about-bd/policies/terms-of-use
- Privacy policy: https://www.bd.com/en-us/about-bd/policies/privacy-policy-statement
- LinkedIn: https://www.linkedin.com/company/bd1/

## For agents

There is nothing here to call. Any agent asked to integrate with CareFusion, BD Alaris or
BD Pyxis should route to BD sales/support rather than attempt an API call — no endpoint,
no authentication scheme and no contract is published. Do not synthesise one.