Security, data and compliance in Cloud Content

How Cloud Content protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Administration, support and folder ownership are separate roles, and Moraph's administrators do not open your content without authorization.

Business associate agreements

Moraph signs a business associate agreement with you for its administration and support, alongside your agreement with Box for the Box service.

Encryption and keys

Box encrypts content as part of its service, and Moraph staff cannot use their administrative access to reach content without your explicit, time-bound authorization.

Complete audit trail

Every configuration change, access grant, restore and authorized content access by Moraph is logged with the person and time.

Data residency

Records Moraph keeps about the service stay in the hosting region you choose: the United States, the United Kingdom or Australia. Where Box stores content follows your Box agreement.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400-414)
• HITECH Act
• Federal Policy for the Protection of Human Subjects (Common Rule, 45 CFR Part 46)
• 21 CFR Part 11, for research records where it applies

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Box cloud service: Box operates the content platform in its cloud under your Box agreement; Moraph configures and administers it for you.
• Existing Box enterprise: Where you already use Box, Moraph reviews and takes over administration of your existing enterprise without moving content again.
• With other Moraph services: Run alongside Moraph's Email Security, Identity Governance or Clinical Collaboration services.

Limitations

• Moraph is not Box. Box's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Box's terms, and some features described here, such as classification, threat alerts and retention, depend on the add-ons you license.
• Box is a content platform, not an electronic health record or a research data capture system. Clinical documentation stays in your EHR.
• A business associate agreement with Box is your organization's agreement with Box; Moraph's agreement covers only Moraph's administration and support.
• Sharing rules reduce the chance of content being shared wrongly; they cannot stop an authorized person from sharing data they are permitted to share.
• What is migrated, archived or deleted, and how long content is kept, are your organization's decisions.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Moraph supports your audits and research compliance reviews with evidence; it does not certify your compliance with HIPAA or 21 CFR Part 11.