Security, data and compliance in Secure Messaging

How Secure Messaging protects data and supports your compliance obligations.

Security controls

Encrypted messaging

TigerConnect encrypts messages in transit and at rest on its platform and in the app, and Moraph configures lifespan and recall to your policy.

Single sign-on

Clinicians sign in through your identity provider where supported, and Moraph's staff sign in to Moraph systems with multi-factor authentication.

Role-based access

Clinicians see their own conversations, and Moraph's service team works on configuration and interfaces rather than message content.

Controlled privileged access

Moraph's administrative rights are granted by your IT team, used only for approved work, and keys and credentials cannot be used without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001, and Moraph signs a business associate agreement with you. TigerConnect's own assurance reports are available from TigerConnect under its terms.

Data residency

Messages are held where TigerConnect hosts your organization's service, and Moraph's service records are held in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400-414)
• Medicare Conditions of Participation: medical record services (42 CFR 482.24)
• CMS memorandum on texting of patient information among healthcare providers (S&C 18-10-ALL, as revised)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• TigerConnect cloud, managed by Moraph: TigerConnect hosts the service; Moraph configures and operates it for you under a managed service agreement.
• Moraph-managed with your existing licenses: If you already license TigerConnect, Moraph can take over configuration, interfaces and operations, subject to TigerConnect's terms.
• Alongside other Moraph services: Run with Moraph's Clinical Collaboration, Enterprise Mobility or Physician On-Call Scheduling so communication, devices and schedules are managed together.

Limitations

• Moraph is not TigerConnect. The platform belongs to TigerConnect, and TigerConnect's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to TigerConnect's terms, and features such as scheduling, alarm and nurse call integrations depend on the modules you license.
• Messages reach clinicians only when their phones are on, connected and running the app. Your organization needs a downtime fallback, and pagers may still be needed in areas with poor coverage.
• Routing is only as accurate as your schedules and directory. Errors in either can send messages to the wrong person, so ownership of both matters.
• Interfaces depend on what your lab, EHR, nurse call and other systems can send. Some alerts may not be available to route.
• Secure messaging does not replace your medical record. Orders and documentation follow your policies and belong in the EHR.
• Moraph does not make clinical routing, escalation or retention decisions. Your organization approves them and remains responsible for HIPAA compliance.
• Clinical alarm management decisions, including which alarms are sent to phones, remain with your clinical and biomedical engineering teams.