Security, data and compliance in Pharmacy Diversion Monitor

How Pharmacy Diversion Monitor protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Restricted investigations

Case records are visible only to the people named on them, and the existence of a case is hidden from everyone else.

Business associate agreement

Moraph signs a business associate agreement with your organization, because the product processes protected health information.

Encryption and keys

Data is encrypted in transit and at rest, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view of a flag or case, every decision and every export is logged with the person and time, and cannot be edited.

US hosting

Data is hosted in Moraph's United States region; every release passes security testing gates and ships with a software bill of materials.

Requirements it supports

• Controlled Substances Act (21 U.S.C. 801 et seq.)
• DEA security requirements for registrants (21 CFR 1301.71 to 1301.76)
• DEA theft or significant loss reporting (21 CFR 1301.76(b), DEA Form 106)
• DEA recordkeeping requirements (21 CFR Part 1304)
• Medicare Conditions of Participation: pharmaceutical services (42 CFR 482.25)
• HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, with interfaces to your cabinet, EHR and scheduling systems.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• Health system deployment: One deployment across several hospitals, so clinicians who work at more than one site are seen in full, with each site's team seeing its own work.

Limitations

• A flag is a statistical or rule-based signal, not evidence of diversion. Your team reviews each flag and decides what it means.
• Analysis depends on complete and timely data from dispensing cabinets, the EHR and scheduling systems. Gaps in any of them reduce what can be detected.
• It does not submit DEA Form 106 or any other report. Your DEA registrant reviews, approves and submits reports through the DEA's own channels.
• It does not make employment, licensing board or law enforcement decisions or referrals; those follow your policies and are made by your staff.
• It is not a dispensing cabinet system or an inventory system, and it does not control access to medications.
• Diversion that leaves no trace in the connected data, such as tampering with a vial after a documented administration, may not be detected.
• Drug testing, security camera review and other investigation steps are recorded in the case but carried out with your own processes and systems.
• It is designed for US controlled substance requirements; rules in other countries are not included.