Security, data and compliance in Integration Engine

How Integration Engine protects data and supports your compliance obligations.

Security controls

Business associate agreement

Moraph signs a business associate agreement with you, since running the engine involves access to PHI.

Role-based access

Who can view message content, change interfaces or reprocess messages follows their role and is reviewed periodically.

Encrypted transport and storage

Connections use encrypted transport where the connected systems support it, and stored messages are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Changes, approvals, reprocessing and access to message content are logged with the person and time.

Tested releases

Moraph's security testing gates every release of its own tooling, and interface changes go through test before production.

Data residency

Where Moraph hosts the engine, data stays in the region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA transaction and code set standards (45 CFR Part 162)
• 21st Century Cures Act information blocking rule (45 CFR Part 171)
• CMS Interoperability and Patient Access final rule (CMS-9115-F)
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: The engine runs in Moraph's hosted environment in the United States, United Kingdom or Australia region, with secure connections to your systems.
• Your data center or cloud account: Where systems must stay on your network, the engine runs in your environment and Moraph operates it by agreement.
• Your existing licence: Where you already license Mirth Connect or Rhapsody, Moraph takes over build and operation, subject to the vendor's terms.

Limitations

• Moraph is not the vendor. NextGen Healthcare (Mirth Connect) and Rhapsody own their engines, and their own service commitments, support terms, roadmaps and outages apply.
• Licences are subject to the vendor's terms, which may limit the editions, connectors or environments available to you.
• Moraph does not operate or change your EHR, lab, radiology or other connected systems; interfaces are limited by what those systems expose, and their vendors' work is arranged by you.
• Decisions about which data goes to which system or partner, and the agreements behind them, are your organization's.
• Moraph fixes interface faults but does not correct clinical data in source systems; that stays with the system's owner.
• Clinical follow-up when a result or order is delayed is your organization's responsibility.
• Breach assessments and notifications after a misrouting incident remain your organization's responsibility, with Moraph's support.
• This service manages Mirth Connect and Rhapsody; other integration engines are not included.