Skip to content

Moraph for clients

Sign in

Getting started

Getting started with Identity Governance

What Identity Governance is for, who uses it, what you need before you start, and your first steps.

Applies to Identity Governance as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.

Last reviewed 2 min readReport a problem
On this page
  1. What it is for
  2. Who uses it
  3. Before you start
  4. Steps to get started
  5. Where to go next

Moraph resells, implements and runs SailPoint identity governance for hospitals and health systems. We build role models from your HR and scheduling data so that a nurse's access to the EHR and other clinical systems follows their unit and job, changes when they transfer, and ends when they leave, supporting the HIPAA minimum necessary standard. SailPoint runs the platform; Moraph configures and operates it, runs the access reviews with your managers, and your organization decides who should have access.

What it is for

In most hospitals, access to the EHR and other clinical systems is granted by ticket and copied from a colleague, so people collect access as they float, transfer and change jobs. Unit-based restrictions in the EHR depend on someone assigning the right security template, and leavers keep accounts in systems that are not connected to HR. Access reviews are spreadsheets sent to managers who approve everything, and when a privacy officer or auditor asks why someone could see a record, the answer is hard to reconstruct.

  • Access is copied from colleagues and accumulates as staff transfer, float and change roles
  • EHR security templates and unit assignments are set by hand and drift from the person's actual job
  • Leavers and contractors keep access in systems not connected to HR
  • Access reviews are rubber-stamped spreadsheets that are hard to evidence

Who uses it

  • Hospitals and health systems with an EHR and many connected clinical and business applications
  • CISOs, identity and access management teams and IT security leaders
  • Privacy officers responsible for the minimum necessary standard
  • Nurse managers and department leaders who approve and review their staff's access
  • Internal audit and compliance teams who test access controls

Before you start

  • Your organization uses Identity Governance as a managed platform from Moraph, under an agreement that covers it.
  • Licences for SailPoint, bought through Moraph or under your own agreement with the vendor.
  • A Moraph account in your organization for each person who works with Moraph on the service.
  • Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

  1. Agree the scope of the managed service for Identity Governance with Moraph, including which environments and teams it covers.

  2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

  3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

  4. Confirm how users will sign in, through your identity provider where the platform supports it.

  5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

Was this page helpful?

Report a problem with this page
What’s the problem?
Quote the step or heading if you can. Don’t include passwords or personal records.
Only if you’d like a reply. We use it for this report and nothing else.

Need help with your own setup rather than this page? Raise a support ticket.