Security, data and compliance in Secure Printing

How Secure Printing protects data and supports your compliance obligations.

Security controls

Named Moraph administrators

Moraph staff work in PaperCut with individual accounts and only the administrative rights the service needs; there are no shared accounts.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Business associate agreement

Print jobs and logs can contain protected health information, so Moraph works under a business associate agreement with you.

Complete audit trail

PaperCut records print and administrator activity, and Moraph's change record links each change and each print record search to its request and approval.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. PaperCut's own commitments cover its software.

Requirements it supports

• HIPAA Privacy Rule safeguards (45 CFR 164.530(c))
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
• Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
• CMS Conditions of Participation for hospitals: medical record services (42 CFR 482.24)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells PaperCut licences and runs the service as one, subject to PaperCut's terms.
• Your existing PaperCut system: If you already license PaperCut, Moraph reviews the current configuration against a new baseline and takes over its operation.
• Co-managed: Your IT team keeps some tasks, such as first-line support or queue deployment to workstations, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not PaperCut. PaperCut provides the software, and its own support commitments, roadmap and release schedule apply, as do any outages of services it hosts.
• PaperCut licences are subject to PaperCut's terms, and some capabilities depend on the edition licensed and the device model.
• Secure release works only on supported devices with supported badge readers. Devices that cannot support it are replaced, restricted or recorded as exceptions.
• Some clinical printing, such as wristbands, labels and specimen printing, usually cannot wait for a badge tap; it stays on exception devices with compensating controls.
• Moraph does not supply, lease or repair print devices unless agreed separately; hardware faults go to your device supplier.
• Secure release protects pages at the printer. It does not stop an authorized user from mishandling a document after collecting it.
• Moraph configures controls with reference to HIPAA safeguards, but your organization decides whether they are adequate and makes all privacy and breach notification decisions.
• Fax, mail and paper records management are outside this service.