Security, data and compliance in Referral & Prior Auth Gateway

How Referral & Prior Auth Gateway protects data and supports your compliance obligations.

Security controls

Business associate agreement

Moraph signs a business associate agreement covering the protected health information the Gateway processes.

Encryption and key control

Client data is encrypted, with keys Moraph staff cannot access without explicit, time-bound authorization, as described in our Trust Center.

Role-based access

Staff see the queues and records their role needs, and administrators control who has which role.

Minimum necessary

Request packets include the documents the payer's requirements call for, not the whole chart.

Audit logging

Every view, change, submission and export is logged with the user and time, and available for your compliance reviews.

Independent assurance

The Gateway runs within Moraph's SOC 2 Type II and ISO/IEC 27001 programs; reports are available under confidentiality terms through the Trust Center.

Requirements it supports

• HIPAA transaction standards (X12 270/271 and 278)
• CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
• HIPAA Privacy and Security Rules
• HL7 FHIR and the HL7 Da Vinci implementation guides (CRD, DTR, PAS)
• State prior authorization laws, as configured for your payers

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States region, under a business associate agreement.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• Phased rollout: Can start with one department, service line or set of payers and expand under the same configuration.
• With a managed service: Optionally paired with a Moraph managed service for interface monitoring and platform administration.

Limitations

• Where a payer accepts requests only through its own portal, the Gateway prepares the request and a specialist submits it there.
• Medical-necessity documentation comes from your clinicians. The Gateway gathers it; it does not write it.
• Approval decisions are the payer's. The Gateway makes requests complete and visible, but cannot guarantee an outcome.
• Payer rules are configured with you during implementation and need to be kept current as payer policies change.
• Payer prior authorization APIs are only used where a payer offers one and the connection has been set up; availability varies by payer.
• Electronic eligibility and 278 transactions depend on your clearinghouse supporting them for each payer.
• It does not submit claims or post payments. It works alongside your billing system.
• Appeals are tracked and supported with the request history, but appeal letters are written by your staff.