Security, data and compliance in Credentialing & Privileging Portal

How Credentialing & Privileging Portal protects data and supports your compliance obligations.

Security controls

Business associate agreement

Where protected health information is involved, Moraph signs a business associate agreement before any data is loaded.

Role-based access

Each person sees only the files and actions their role allows; committee members see only packets assigned to them.

Encryption

Client data is encrypted, with keys Moraph staff cannot access without explicit, time-bound authorization, as described in our Trust Center.

Single sign-on and two-step verification

Staff sign in through your identity provider; practitioners use a secure account with two-step verification.

Complete audit trail

Every view, change, verification and approval is logged with the person and time.

Independent assurance

The product runs under Moraph's company-wide controls, independently audited for SOC 2 Type II and ISO/IEC 27001.

Requirements it supports

• The Joint Commission Medical Staff (MS) standards
• NCQA Credentialing and Recredentialing standards
• CMS Conditions of Participation for hospitals (42 CFR 482.22)
• OIG exclusion screening (Social Security Act section 1128)
• National Practitioner Data Bank query requirements (45 CFR Part 60)
• HIPAA privacy and security rules

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States region, under a business associate agreement where protected health information is involved.
• Dedicated environment: Single-tenant hosting for health systems whose policies require it, scoped in the proposal.
• Multi-facility setup: One instance for a health system with several hospitals or medical staffs, each with its own forms, committees and approvals.
• With a managed service: Optionally run alongside a Moraph managed service for platform administration and configuration changes.

Limitations

• Some licensing boards and certifying bodies offer no automated lookup. Those verifications are completed by a specialist and recorded in the portal.
• National Practitioner Data Bank queries are made by your organization under its own NPDB registration. The portal records the result.
• It hands verified information to payer enrollment but does not submit enrollment applications to payers.
• It is not a credentials verification organization. Moraph does not perform verifications on your behalf or certify your files.
• Professional practice evaluation data is recorded in the portal; it does not extract quality measures from your EHR.
• Privilege criteria and forms are owned by your departments and must be kept current by your medical staff office.
• It does not manage practitioner scheduling, payroll or contracts.
• The workflow supports accreditation standards; meeting them remains your organization's responsibility.