Security, data and compliance in Asset Tracking

How Asset Tracking protects data and supports your compliance obligations.

Security controls

Named Moraph administrators

Moraph staff work in AeroScout with individual accounts and only the administrative rights the service needs; there are no shared accounts.

Role-based access

What each person at your hospital and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Patient information

The service tracks equipment, not people. Where location data could be linked to a patient, it is handled as protected health information under a business associate agreement.

Complete audit trail

Moraph's change record links every configuration change to its request and approval, alongside the activity AeroScout records.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. The vendor's own commitments cover the platform.

Requirements it supports

• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• CMS Conditions of Participation for hospitals: physical environment (42 CFR 482.41)
• The Joint Commission Environment of Care standards for medical equipment management
• NFPA 99 Health Care Facilities Code

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences and hardware through Moraph: Moraph resells AeroScout software, tags and exciters and runs the system as one service, subject to the vendor's terms.
• Your existing AeroScout system: If you already own AeroScout, Moraph reviews the current configuration and tag estate against a new baseline and takes over its operation.
• Co-managed: Your clinical engineering team keeps some tasks, such as tagging new equipment, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not Stanley Healthcare. The vendor provides the AeroScout platform, and its own service commitments, roadmap, maintenance and outages apply.
• AeroScout software, tags and exciters are subject to the vendor's licence and warranty terms.
• Location accuracy depends on your Wi-Fi network and on where exciters are installed. Areas without exciters show a less precise location.
• Moraph does not own or run your wireless network; network problems are fixed by your network team or its provider.
• Only tagged equipment can be located. Tags can be removed or damaged, and devices whose tags have stopped reporting show their last known location.
• The service tracks equipment. Patient and staff tracking, infant protection and hand hygiene monitoring are not included unless agreed separately.
• Moraph does not perform maintenance on medical devices or decide how they are managed, maintained or recalled; your clinical engineering team does.
• The tracking system is not a replacement for your maintenance management system, which stays the record of maintenance work.