Security, data and compliance in Home Health Logistics Planner

How Home Health Logistics Planner protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply on office computers and phones.

Role-based access

Clinicians see only their own patients and visits; office staff see their own branch.

Protected health information

Patient details on phones are limited to what the visit needs, and Moraph signs a business associate agreement with your organization.

Location only during visits

The app records a clinician's location at check-in and check-out, not continuously through the day.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail and residency

Every change, verification and correction is logged with the person and time and cannot be edited, and data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• 21st Century Cures Act, Section 12006 electronic visit verification (42 U.S.C. 1396b(l))
• State Medicaid EVV requirements and aggregator specifications
• Medicare Home Health Agency Conditions of Participation (42 CFR Part 484)
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
• Fair Labor Standards Act rules for domestic service employment (29 CFR Part 552)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Mobile app: The clinician app runs on iOS and Android phones, managed or personal, according to your device policy.
• With a managed service: Optionally run alongside a Moraph managed service for aggregator submission monitoring and application administration.

Limitations

• It is not certified or approved for EVV in every state. Some states require agencies to use the state-provided system, and others require each alternate system to pass testing; availability is confirmed state by state during implementation.
• It does not submit claims to Medicare, Medicaid or other payers. It marks visits ready for billing in your agency or billing system.
• It is not an electronic health record and does not capture clinical documentation such as OASIS assessments or visit notes beyond the services recorded for EVV.
• Routes are proposals based on estimated travel times; traffic, weather and clinical needs mean schedulers and clinicians make the final decision.
• Location capture depends on the clinician's phone having location services and a signal; visits without them become exceptions to resolve.
• Decisions about corrections, reason codes and visit records are your agency's; the product records and enforces the approval steps you configure.
• It does not calculate pay, overtime or wage-and-hour compliance; it exports hours, travel time and mileage for your payroll process.
• Ordered visits and frequencies must come from your agency system; the planner does not create or change plans of care.