Security, data and compliance in Ambulance Run Data Sync

How Ambulance Run Data Sync protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person sees follows their role and department; registration sees what it needs to match, not the full clinical record.

Business associate agreement

Moraph signs a business associate agreement with your organization, because the product processes protected health information.

Encryption and keys

Data is encrypted in transit from EMS agencies and at rest, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every message received, view, match, filing and feedback release is logged with the person or system and time, and cannot be edited.

US hosting

Data is hosted in Moraph's United States region; every release passes security testing gates and ships with a software bill of materials.

Requirements it supports

• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
• Emergency Medical Treatment and Labor Act (EMTALA, 42 U.S.C. 1395dd)
• Medicare Conditions of Participation for emergency services (42 CFR 482.55)
• 21st Century Cures Act information blocking rule (45 CFR Part 171)
• NEMSIS Version 3 national EMS data standard
• State EMS patient care reporting and trauma system rules

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, with interfaces to your EHR and to agency ePCR systems.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• Regional deployment: One deployment shared by several hospitals in a region or health system, with each hospital seeing only the units bound for it.

Limitations

• It is not an ePCR system. EMS crews document in their own software, and the product shows what that software sends.
• Pre-arrival information depends on each agency connecting, its crews documenting en route and network coverage along the route. A radio or phone report remains necessary when data does not arrive.
• It does not decide whether to activate a trauma or specialty team. Highlighting follows rules your trauma program sets, and the decision is made and recorded by your staff.
• It does not replace your EHR or ED tracking board; it adds pre-arrival information to them.
• It is not a computer-aided dispatch or ambulance tracking system. Estimated arrival times are those the crew or its software sends.
• Patient matching is confirmed by a person. Records that cannot be matched stay in a work list until resolved.
• Outcome feedback to EMS agencies is released only by your staff under your disclosure policies; the product does not decide what may be shared.
• It is designed for US emergency departments and the NEMSIS Version 3 standard; EMS data standards in other countries are not included.