First of all, know that this is a fear every single new concealed carrier has, but it’s something that almost never happens. Trust me when I tell you that people just aren’t paying that much attention to you, and even if someone does notice, normal folks will have the social dignity not to ask.
That said, if you ever do get “made” and someone dares to ask, “Is that a gun?,” your response should be tailored to the situation. Is the asker a stranger or someone you know? Do you know if they are 2A-friendly, hostile or neutral? If a well-meaning but socially awkward fellow gun enthusiast asks, a simple yes and a finger raised to the lips in a conspiratorial-style “shh!” gesture will probably get the message across that you don’t want to talk about this in public but you’re on the same team.
If you’re dealing with a stranger, you have a few options if you know they suspect you’re carrying a gun but can’t tell for sure. The first is a straight-up lie: “No, it’s a medical device, but I prefer not to get into the personal details” will keep all but the most dense or paranoid strangers from asking more questions. The second option is the truth: “Yes, I’m a well-trained concealed carry holder” might help you spark a conversation with someone who is new to or hesitant about firearms, or it might set off an absolute panic—you’ll have a good sense of which way it will go by the tone and body language they used when they asked the question in the first place. You should also have a sense of the general tone of where you are when the question is asked: If you’re at a small-town Texas barbeque joint, you’re probably in a friendly atmosphere. At an upscale sushi bar in a liberal city, you’re likely outnumbered philosophically speaking and should tread lightly.
Because this question is so inappropriate to ask a stranger and I’m a big fan of pointing out peoples’ rudeness, I like option three: turning this situation around and calling it out for what it is. “Don’t you think that’s an inappropriate question to ask a total stranger?” is a legit response that puts the burden back on them to explain why they dared violate the norms of social graces in the first place.
Unless you’re really a crusader, the last thing you want is to allow the situation to escalate into an argument or a scene, so use your best judgement based on who asked the question and how it was presented as to whether the truth, a lie or a redirected call-out might be the wisest choice. But rest assured that you’ll probably never have to deal with this situation, because the only people who will notice that you’re carrying are the people who are looking for it, and those people are on your side.