Security, data and compliance in Single Sign-On

How Single Sign-On protects data and supports your compliance obligations.

Security controls

Multi-factor administration

Your administrators and Moraph's staff sign in to Imprivata administration with multi-factor authentication, and access is removed when people leave.

Role-based access

The badge office manages enrollments, the service desk sees enrollment status, and Moraph's service team works on configuration rather than clinical data.

Recorded changes and record requests

Every configuration change and every request for sign-in records is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Imprivata's own assurance documentation is available from Imprivata under its terms.

Business associate agreement

Where the service involves PHI, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Requirements it supports

• HIPAA Security Rule (45 CFR Part 164, Subpart C), including access control and person or entity authentication at 45 CFR 164.312
• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• DEA electronic prescriptions for controlled substances (21 CFR Part 1311)
• NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Imprivata in your data center, managed by Moraph: Imprivata servers or virtual appliances run in your environment, and Moraph configures and runs them remotely under a managed service agreement.
• Moraph-managed with your existing licenses: If you already license Imprivata, Moraph can take over configuration and operations, subject to Imprivata's terms.
• Alongside other Moraph services: Run with Moraph's Identity Governance, Enterprise Mobility or Network Access Control services so identity, devices and network access are managed together.

Limitations

• Moraph is not Imprivata. The software belongs to Imprivata, and Imprivata's own support commitments, roadmap and product defects apply to it.
• Licenses are subject to Imprivata's terms. Features such as two-factor signing for EPCS and self-service password reset depend on the products you license.
• Some applications cannot be profiled, or need rework after each upgrade. Moraph tests profiles before upgrades but cannot guarantee every application version will work with badge sign-on.
• Badge sign-on depends on your directory, network, workstations and readers. Moraph does not supply badge readers or workstations.
• Moraph does not issue badges or verify identity; your badge office and onboarding processes do that.
• Your organization remains responsible for HIPAA access controls, its EPCS obligations under DEA rules, and decisions about timeouts and exceptions.
• Where Imprivata runs in your data center, its availability depends on your infrastructure as well as Moraph's monitoring.