Security, data and compliance in Cloud Fax

How Cloud Fax protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's staff sign in through identity providers with multi-factor authentication where the platform supports it, and access is removed when people leave.

Role-based access

Intake staff see their department's faxes, administrators manage configuration, and auditors see evidence rather than fax content.

Logged content access

Every opening of fax content by Moraph staff is recorded with the person, time and the ticket it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. eFax Corporate's own assurance documentation is available from its provider under its terms.

Business associate agreements

Moraph signs a business associate agreement for the service, and the provider of eFax Corporate signs its own under its terms. Moraph's routing runs in the United States region.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C), including transmission security at 45 CFR 164.312(e)
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
• ONC information blocking rules under the 21st Century Cures Act (45 CFR Part 171)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• eFax Corporate cloud, managed by Moraph: eFax Corporate runs in its provider's cloud; Moraph configures it and runs the routing to your EMR under a managed service agreement.
• Moraph-managed with your existing account: If you already use eFax Corporate, Moraph can take over configuration, routing and operations, subject to its provider's terms.
• Alongside other Moraph services: Run with Moraph's Integration Engine or Referral & Prior Auth Gateway so faxed documents feed the same intake as electronic ones.

Limitations

• Moraph is not Consensus Cloud Solutions, the provider of eFax Corporate. The platform belongs to its provider, and the provider's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses and numbers are subject to the provider's terms, and some numbers may not be portable from your carrier.
• Moraph does not index or file documents. Your staff confirm the patient and document type before anything is filed to a chart.
• Delivery into the EMR depends on the import methods your EMR supports and on your interface team's configuration.
• Fax remains an unstructured, page-image format. Cloud fax removes paper and manual routing; it does not turn faxes into structured data.
• Faxes sent to a wrong number by the sender, or by your staff, still reach that number. Moraph can report misdirected faxes but cannot recall them.
• Your organization remains responsible for HIPAA and 42 CFR Part 2 compliance, its retention policy and breach notification decisions.
• Analog lines for devices that are not fax machines, such as alarms or elevators, are not part of the service.