Security, data and compliance in Remote Patient Monitoring

How Remote Patient Monitoring protects data and supports your compliance obligations.

Security controls

Business associate agreement

Moraph signs a business associate agreement with your organization because the service involves PHI, and Vivify's own agreement covers the platform.

Named Moraph staff

Moraph staff work with individual accounts, the least rights the service needs and multi-factor authentication; there are no shared accounts.

Role-based access

Care teams see their own patients, coordinators see enrollment and kits, and Moraph sees what technical support requires.

Complete audit trail

The platform's access logs and Moraph's change and ticket records show who did what and when.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

People decide

Thresholds flag readings for review; clinicians decide on care, and Moraph tooling never contacts patients about their health.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
• Medicare Physician Fee Schedule remote physiologic monitoring codes (CPT 99453, 99454, 99457 and 99458)
• 21st Century Cures Act information blocking rules (45 CFR Part 171)
• Telephone Consumer Protection Act (47 U.S.C. 227), for automated patient calls and texts

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the Vivify subscription and runs it as one service, subject to Vivify's terms.
• Your existing Vivify program: If you already license Vivify, Moraph reviews pathways, thresholds and integrations and takes over operation.
• Co-managed: Your team keeps some tasks, such as enrollment or patient technical support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not Vivify Health. Vivify operates the platform, and Vivify's own service commitments, roadmap, maintenance and outages apply.
• Vivify licences are subject to Vivify's terms. Devices and kits are priced separately.
• Remote monitoring is not an emergency service. Patients must be told how to get urgent help, and readings are reviewed during the hours your program sets.
• Moraph does not review readings for clinical purposes, contact patients about their health or make care decisions; your clinicians do.
• Moraph does not decide what is billed or submit claims. Billing rules for remote monitoring change, and your revenue cycle team checks them.
• Monitoring depends on patients using their devices and on home connectivity. Some patients will need a cellular-connected kit or extra support.
• Only devices the platform supports can send readings automatically; others need manual entry.
• Moraph does not make privacy or breach notification decisions; your privacy officer does.