Security, data and compliance in Blood Bank Inventory & Safety

How Blood Bank Inventory & Safety protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person sees follows their role; nurses report reactions for their own areas, and only designated staff record dispositions.

Protected health information

Patient details are limited to the roles that need them, and Moraph signs a business associate agreement with your organization.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every entry, review, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• FDA current good manufacturing practice for blood and blood components (21 CFR Part 606)
• FDA biological product deviation reporting (21 CFR 606.171)
• Clinical Laboratory Improvement Amendments (42 CFR Part 493)
• CMS hospital Conditions of Participation for laboratory services (42 CFR 482.27)
• AABB Standards for Blood Banks and Transfusion Services
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for interface monitoring and application administration.

Limitations

• It is not blood establishment computer software and is not cleared by the FDA as a medical device. Compatibility testing, crossmatch decisions, electronic issue and product release stay in your FDA-cleared blood bank system.
• It does not label, modify or manufacture blood components, and it does not replace the records your blood bank system must keep.
• It does not submit reports to the FDA, NHSN or any other body. Your staff review, approve and submit each report.
• Reaction classification and the decision whether an event is reportable are made by your medical director, not the software.
• Temperature records depend on the monitoring devices and data loggers you provide and on their calibration; it does not replace an alarm system that alerts staff locally.
• It does not manage blood donor collection, donor eligibility or donor records.
• Inventory shown is only as current as the events your blood bank system sends; units handled outside that system must be recorded there first.
• Your organization remains responsible for validating the configured system under its own quality system.