Security, data and compliance in Clinical Collaboration

How Clinical Collaboration protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through Microsoft Entra ID under your multi-factor and conditional access policies, and Moraph's staff sign in to Moraph systems through Moraph's own identity provider.

Role-based access

Clinicians see the teams they belong to, and Moraph's service team works on configuration rather than content.

Controlled privileged access

Moraph's administrative roles in your tenant are granted by your IT team, used only for approved work, and keys and credentials cannot be used without explicit, time-bound authorization.

Complete audit trail

Every change Moraph makes is recorded in the service records with the request and approval behind it, and Microsoft's audit log records actions in the tenant.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own compliance reports for Microsoft 365 are available from Microsoft under its terms.

Data residency

Teams content stays in the Microsoft 365 data location of your tenant, and Moraph's service records are held in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400-414)
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
• Medicare telehealth services (42 CFR 410.78)
• State telehealth, consent and recording laws where your clinicians and patients are located

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Your Microsoft 365 tenant, managed by Moraph: Teams runs in your organization's tenant; Moraph configures and operates it for you under a managed service agreement.
• With licenses bought through Moraph: Moraph resells the Microsoft licenses you need and manages them alongside the service, subject to Microsoft's terms.
• Alongside other Moraph services: Run with Moraph's Secure Messaging, Single Sign-On or Identity Governance services so clinical communication and access are managed together.

Limitations

• Moraph is not Microsoft. Teams and Microsoft 365 belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
• Licenses are subject to Microsoft's terms, and some controls described here, such as sensitivity labels, advanced retention or virtual appointment features, depend on the licenses you hold.
• Business associate coverage for Microsoft services comes from your agreement with Microsoft. Moraph's BAA covers Moraph's services, not Microsoft's.
• Teams is a communication tool, not your medical record. Clinical documentation, orders and results belong in your EHR.
• Moraph does not make privacy, retention or clinical policy decisions. Your organization approves them and remains responsible for HIPAA compliance.
• Patient-side experience depends on the patient's device, browser and connection, which neither Moraph nor Microsoft controls.
• State telehealth, licensure, consent and recording rules vary, and legal advice on them is not part of the service.
• Moraph does not routinely read chats, files or recordings, so the service does not detect inappropriate content unless you configure and review tools for that purpose.