Security, data and compliance in Policy Management

How Policy Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Everyone signs in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Staff see only approved policies; drafts, archived versions and approval comments are limited to the roles that need them.

Controlled Moraph access

Moraph staff use named accounts with the access your organization authorizes, and changes are made through approved change requests.

Audit trail

Edits, approvals, publications and attestations are recorded with who did them and when.

Encryption and keys

Data Moraph holds for the service, such as migration files and evidence exports, is encrypted with keys staff cannot use without explicit, time-bound authorization.

No patient information by design

Policies should not contain patient information, and migration checks flag documents that appear to. Where your use involves protected health information, a business associate agreement is put in place first.

Requirements it supports

• CMS Conditions of Participation for Hospitals (42 CFR Part 482)
• The Joint Commission accreditation standards for leadership and policy management
• DNV NIAHO hospital accreditation requirements
• HIPAA Privacy Rule policies and documentation (45 CFR 164.530(i) and (j))
• HIPAA Security Rule policies and documentation (45 CFR 164.316)
• State hospital licensing regulations

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• New RLDatix subscription: Moraph resells the subscription and runs the platform from implementation onward.
• Your existing subscription: Where you already license the RLDatix platform, Moraph takes over configuration and operation, subject to the vendor's terms.
• Alongside other Moraph services: Can be run with Moraph's managed Learning Management service so changed policies are assigned for attestation or training.

Limitations

• Moraph is not the vendor. RLDatix owns and operates the platform, and its own service commitments, roadmap and outages apply.
• Licences are subject to RLDatix's terms, and the features available depend on the edition and modules you license.
• Moraph does not write, approve or take responsibility for the content of your policies; owners and approvers remain accountable for them.
• Moraph does not give legal or accreditation advice. Linking policies to standards helps find gaps, but deciding what a standard requires is your organization's judgment.
• Migration quality depends on the source documents. Approval history that was never recorded cannot be recreated and is marked as unknown.
• A downtime copy of critical policies under your business continuity plan remains your organization's responsibility.
• First-line help for staff stays with your service desk or policy office, with Moraph providing second-line support.
• The service is not an incident reporting or document control system for medical device or laboratory quality systems.