Security, data and compliance in Hospital Command Center Dashboard

How Hospital Command Center Dashboard protects data and supports your compliance obligations.

Security controls

Business associate agreement

Moraph signs a business associate agreement with you, since the dashboard handles PHI.

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Patient-level detail is limited to the roles and units that need it; executives and support services see summaries.

Encryption and keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Views of patient detail, bed changes, surge levels and exports are logged with the person and time.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Emergency Medical Treatment and Labor Act (EMTALA, 42 U.S.C. 1395dd and 42 CFR 489.24)
• Medicare Conditions of Participation for hospitals (42 CFR Part 482)
• Discharge planning Condition of Participation (42 CFR 482.43)
• Emergency preparedness Condition of Participation (42 CFR 482.15)
• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, with United Kingdom and Australia regions for organizations outside the US.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph's Integration Engine service, which builds and monitors the feeds the dashboard depends on.

Limitations

• The dashboard does not make clinical, admission, discharge or bed placement decisions. Your clinicians and bed managers do.
• It is not the system of record for beds or patients; your EHR remains so, and the dashboard is only as current and accurate as the feeds it receives.
• Demand forecasts are planning aids based on your history and can be wrong, especially during unusual events.
• It does not replace your ED tracking board, transfer center software or EHR bed board; it brings their information together.
• EMTALA obligations, surge plans and patient flow policies are your organization's; the dashboard records actions but does not ensure compliance.
• It does not dispatch environmental services or transport staff unless those systems are connected.
• It is not intended for regional or multi-hospital load balancing between unaffiliated organizations.