Security, data and compliance in Residency Program Manager

How Residency Program Manager protects data and supports your compliance obligations.

Security controls

Single sign-on

Users sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Residents see their own records, faculty see procedures they supervised, and program staff see only their own program.

Patient information kept to a minimum

Procedure logs are designed for de-identified case details; where any patient information is involved, Moraph signs a business associate agreement.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every entry, change, verification and review is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• ACGME Common Program Requirements (Residency), Section VI on clinical experience and education
• ACGME Common Program Requirements (Fellowship)
• ACGME Institutional Requirements
• ACGME specialty-specific Program Requirements and case log minimums
• Medicare graduate medical education payment rules (42 CFR 413.75 to 413.83)
• HIPAA Privacy Rule (45 CFR Part 164) for patient details in procedure logs

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for schedule feed monitoring and application administration.

Limitations

• It is not an ACGME system and does not submit data to ACGME. Your coordinators and program directors enter or reconcile data in ACGME's Accreditation Data System and Case Log System.
• Compliance with ACGME requirements and accreditation decisions remain with your programs, the sponsoring institution and ACGME; the product records and reports, it does not certify.
• Work-hour results depend on residents logging accurately. The product reminds and reports gaps, but cannot confirm hours worked that were not recorded.
• It is not a full residency management system: evaluations, milestones, curriculum, recruitment and credentialing are not included.
• It does not calculate Medicare GME payments or prepare cost reports; it provides rotation and site data your finance team can use.
• Procedure logs are designed for de-identified case details; programs should not record patient identifiers in free-text fields.
• Specialty rules and minimums are configured from the requirements in force at implementation and must be updated by your programs when ACGME revises them.
• It does not handle resident payroll or time-and-attendance for pay purposes.