Getting started with Patient Privacy Monitoring

Moraph resells, implements and runs FairWarning patient privacy monitoring for hospitals and health systems. We connect FairWarning to your EHR access logs and HR data, configure it to flag access such as staff opening the records of coworkers, family members, neighbors or well-known patients, and triage what it raises so your privacy team works the cases that need a decision. FairWarning provides the platform; Moraph operates it; your organization investigates, decides on sanctions and determines whether a breach occurred.

What it is for

Every day thousands of staff open patient records for legitimate reasons, which makes the few who look without a reason hard to find. Privacy teams are expected to review EHR access regularly, respond quickly when a patient or the press asks who looked at a record, and show that sanctions are applied consistently. Reviewing raw access logs by hand is not practical, and a monitoring platform is only useful if its data feeds stay healthy, its rules are tuned to your organization and someone works its alerts every day.

• Access logs hold millions of entries, and inappropriate access hides among legitimate care
• Snooping on coworkers, relatives, neighbors and well-known patients is found only when someone complains
• Data feeds from the EHR and HR systems break or drift without anyone noticing
• Investigations, findings and sanctions are recorded inconsistently, which is hard to defend

Who uses it

• Privacy officers and privacy teams at hospitals and health systems
• Compliance officers who report on privacy to leadership and the board
• Human resources partners who apply sanctions after a finding
• EHR and IT teams who supply access logs and user data
• Internal audit, who need evidence that access is reviewed

Before you start

• Your organization uses Patient Privacy Monitoring as a managed platform from Moraph, under an agreement that covers it.
• Licences for FairWarning, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Patient Privacy Monitoring with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Patient Privacy Monitoring
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com