Security, data and compliance in Infection Control & Contact Tracing

How Infection Control & Contact Tracing protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person sees follows their role and unit, and employee health information is visible only to employee health.

Business associate agreement

Moraph signs a business associate agreement with your organization, because the product processes protected health information.

Encryption and keys

Data is encrypted in transit and at rest, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, decision, export and report release is logged with the person and time, and cannot be edited.

US hosting

Data is hosted in Moraph's United States region; every release passes security testing gates and ships with a software bill of materials.

Requirements it supports

• Medicare Conditions of Participation: infection prevention and control (42 CFR 482.42)
• HIPAA Privacy Rule disclosures for public health activities (45 CFR 164.512(b))
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)
• CDC National Healthcare Safety Network (NHSN) reporting requirements
• State reportable disease and outbreak reporting laws

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, with interfaces to your laboratory, EHR and staffing systems.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• Health system deployment: One deployment across several facilities, so staff and patients who move between them can be traced, with each facility's team seeing its own work.

Limitations

• Contact lists are only as complete as the location, assignment and schedule data you provide. Without a real-time location system, contacts are based on rooms, units and assignments, not proximity.
• It does not decide who is exposed. It proposes contacts under rules your team sets, and infection preventionists make and record each decision.
• It is not a laboratory system or an EHR, and it does not place isolation orders; it tracks the actions your staff take in those systems.
• It does not submit reports to the health department or NHSN. Your staff review, approve and submit them through their own channels.
• Visitors and contractors are traced only where your facility records their location, such as through a visitor management system you connect.
• It does not provide clinical guidance on treatment or prophylaxis; follow-up actions are the ones your policies define.
• Employee health workflows follow your policies and applicable employment law; the product records decisions but does not set work restriction criteria.
• It is designed for US facilities and reporting requirements; public health reporting formats in other countries are not included.