Security, data and compliance in Identity Governance

How Identity Governance protects data and supports your compliance obligations.

Security controls

Named Moraph administrators

Moraph staff work in your SailPoint tenant with individual accounts, the least administrative rights the service needs and multi-factor authentication; there are no shared accounts.

Business associate agreement

Where the service involves protected health information, Moraph signs a business associate agreement before work begins.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Complete audit trail

SailPoint records requests, approvals, certifications and provisioning, and Moraph's change record links each change to its request and approval.

People decide

Moraph's tooling may suggest roles or flag unusual access, but your managers, application owners and privacy officer make every access decision.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service; service records are encrypted with keys staff cannot use without explicit, time-bound authorization. SailPoint's own attestations cover the platform.

Requirements it supports

• HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))
• HIPAA Security Rule workforce security and information access management (45 CFR 164.308(a)(3) and (a)(4))
• HIPAA Security Rule access controls and audit controls (45 CFR 164.312(a) and (b))
• 42 CFR Part 2, for substance use disorder treatment records
• NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule
• Health Industry Cybersecurity Practices (HICP), 405(d) program

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the SailPoint subscription and runs it as one service, subject to SailPoint's terms.
• Your existing SailPoint: If you already license SailPoint, Moraph reviews the current configuration against a new baseline and takes over its operation.
• Co-managed: Your team keeps some work, such as application onboarding or first-line support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not SailPoint. SailPoint operates the platform, and SailPoint's own service commitments, roadmap, maintenance and outages apply.
• SailPoint licences are subject to SailPoint's terms. Some capabilities, and the number of identities and connectors, depend on the modules licensed.
• SailPoint governs which accounts, roles and entitlements a person holds. Which patients a user can see on a ward is enforced by the EHR's own security settings, which SailPoint assigns but does not replace.
• Automated changes only reach applications that can be connected. Others need manual tasks, which Moraph tracks but application owners complete.
• The role model is only as accurate as your HR data. Missing or wrong job codes, units and managers lead to wrong access until they are fixed at the source.
• This service is not patient privacy monitoring. It does not review which records a user actually opened.
• Moraph configures controls to support HIPAA requirements, but your organization owns the risk analysis and decides whether the controls are adequate. Moraph does not certify compliance.
• Moraph does not make access decisions or accept risk on your behalf; exceptions and violations need a decision from your named approver.