Security, data and compliance in Patient Safety & Incident Reporting

How Patient Safety & Incident Reporting protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role and facility; reporter identities and analyses are limited to the roles you choose.

Protected health information

Reports can contain patient information, so Moraph signs a business associate agreement and handles that information under it.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, decision and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Patient Safety and Quality Improvement Act of 2005 (42 U.S.C. 299b-21 to 299b-26)
• Patient Safety and Quality Improvement Rule (42 CFR Part 3)
• AHRQ Common Formats for Event Reporting
• CMS Conditions of Participation, quality assessment and performance improvement (42 CFR 482.21)
• The Joint Commission Sentinel Event Policy
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph support for form changes, routing rules and new facilities.

Limitations

• Moraph is not a Patient Safety Organization. The app supports your patient safety evaluation system and prepares data for the PSO you contract with.
• Whether a report or analysis is privileged as patient safety work product depends on your PSO arrangements and policies, and on advice from your counsel; the app records the designation you make.
• Supporting AHRQ Common Formats means the data is structured to align with them; the formats are versioned by AHRQ and mapping is reviewed when a new version is adopted.
• It does not decide harm levels, causes or actions. Your patient safety team classifies events and approves analyses.
• It does not report to state agencies or accreditors on your behalf. Reports needed for state adverse event reporting or accreditor review are prepared by your team from the data held.
• It is not a claims management system. Events can be referred to your claims or risk system.
• Anonymous reports cannot be followed up with the reporter, and their usefulness depends on what the reporter provides.
• Patient lookup depends on an interface to your EHR; without it, patient details are entered by the reporter.