Security, data and compliance in Learning Management

How Learning Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Learners and administrators sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Managers see their own staff, educators their own sessions and content, and administrators what their role requires.

Controlled Moraph access

Moraph staff use named accounts with the access your organization authorizes, and changes are made through approved change requests.

Audit trail

Changes to requirements, rules, content and exemptions are recorded with who made them and when.

Encryption and keys

Data Moraph holds for the service, such as HR feed files and evidence reports, is encrypted with keys staff cannot use without explicit, time-bound authorization.

Minimal personal data

The service uses workforce data, not patient information. Where your organization's use involves protected health information, a business associate agreement is put in place first.

Requirements it supports

• OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030)
• OSHA Hazard Communication Standard (29 CFR 1910.1200)
• HIPAA Privacy Rule workforce training (45 CFR 164.530(b))
• HIPAA Security Rule security awareness and training (45 CFR 164.308(a)(5))
• CMS Conditions of Participation for Hospitals (42 CFR Part 482)
• The Joint Commission accreditation standards for staff orientation, education and competence

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• New HealthStream subscription: Moraph resells the subscription and content licences and runs the platform from implementation onward.
• Your existing subscription: Where you already license HealthStream, Moraph takes over configuration and operation, subject to the vendor's terms.
• Alongside other Moraph services: Can be run with Moraph's managed Policy Management service so new policy versions are assigned for attestation.

Limitations

• Moraph is not the vendor. HealthStream owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licences and content are subject to HealthStream's terms, and the courses and features available depend on what you license.
• Your organization decides which training is required, for whom and how often; Moraph configures the platform to match but does not set regulatory requirements.
• Assignment accuracy depends on the HR and contractor data you provide. Moraph detects and reports mapping errors but does not own your HR data.
• Moraph does not write or validate the clinical accuracy of organization-specific content; its owners remain responsible for it.
• Training records show that training was completed; they do not by themselves demonstrate competence, which your educators assess.
• First-line help for learners stays with your service desk or education team, with Moraph providing second-line support.
• The service is not a credentialing system and does not verify licenses or certifications held by staff.