Security, data and compliance in Patient Privacy Monitoring

How Patient Privacy Monitoring protects data and supports your compliance obligations.

Security controls

Single sign-on

Your privacy team signs in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Triage, investigation, sanctions and configuration are separate roles, and each sees only the patient and employee details its work needs.

Business associate agreement

Because the service handles PHI, Moraph signs a business associate agreement with you; your agreement with FairWarning covers its own handling.

Encryption and keys

Case evidence and feed data handled by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization outside the agreed triage role.

Complete audit trail

Every alert decision, case view, finding and configuration change is logged with the person and time, and cannot be edited.

People decide

Analytics and scores suggest what to review; Moraph analysts and your privacy team decide, and every decision has a named person and a reason.

Requirements it supports

• HIPAA Security Rule information system activity review (45 CFR 164.308(a)(1)(ii)(D)) and audit controls (45 CFR 164.312(b))
• HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))
• HIPAA sanctions requirements (45 CFR 164.530(e) and 164.308(a)(1)(ii)(C))
• HIPAA Breach Notification Rule (45 CFR 164.400-414)
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
• State medical privacy laws, such as California Health and Safety Code Section 1280.15

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• FairWarning cloud service: FairWarning operates the monitoring platform in its cloud; Moraph configures and runs it for you.
• Existing deployment: Where you already own FairWarning, Moraph reviews its feeds and rules and takes over operation and triage.
• With other Moraph services: Run alongside Moraph's Identity Governance, Email Security or Pharmacy Diversion Monitor.

Limitations

• Moraph is not FairWarning or its owner, Imprivata. FairWarning's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to FairWarning's licence terms.
• Monitoring is only as complete as the access logs, HR data and patient demographics your systems provide; applications not connected are not monitored.
• Rules and analytics flag access for review; they do not prove that access was inappropriate. Some inappropriate access will look legitimate and will not be flagged.
• Moraph does not interview employees, contact patients, decide findings or sanctions, or determine breaches; those remain with your organization.
• It does not prevent access in the EHR. It finds access after it happens.
• Notification to patients, HHS, state agencies or the media remains your organization's decision and responsibility.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.