Security, data and compliance in Antibiotic Stewardship Tracker

How Antibiotic Stewardship Tracker protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; changing a review rule is separate from working the queue.

Business associate agreement

The Tracker handles protected health information, and Moraph signs a business associate agreement with you.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view of a patient record, change, recommendation and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• CMS Conditions of Participation for hospitals, infection prevention and antibiotic stewardship (42 CFR 482.42)
• Joint Commission antimicrobial stewardship standards (MM.09.01.01 for hospitals)
• CDC Core Elements of Hospital Antibiotic Stewardship Programs
• CDC NHSN Antimicrobial Use and Resistance (AUR) Module
• CMS Medicare Promoting Interoperability Program, AUR surveillance reporting measure
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph's managed integration engine for interface monitoring and support.

Limitations

• The Tracker does not change orders. Prescribers change therapy in the EHR, and the Tracker records recommendations and responses.
• It is decision support for your stewardship team, not a substitute for clinical judgment. Flags are prompts for review, and each recommendation is made by a clinician.
• Flags depend on timely, complete order, administration and microbiology feeds. Delayed or missing results mean delayed or missing flags.
• It does not submit to NHSN itself. Your team reviews and uploads the AUR files it prepares.
• Review rules reflect your local guidelines, which your program sets and maintains; the Tracker does not supply treatment guidelines.
• It is designed for inpatient and hospital-based programs. Outpatient and long-term care stewardship are not included.
• It is not a laboratory information system or an infection surveillance system, although it uses and shares their data.
• Published antibiograms are your microbiology and pharmacy teams' responsibility; the Tracker prepares the data for their review.