Security, data and compliance in Surgical Block Scheduling Optimizer

How Surgical Block Scheduling Optimizer protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; a surgeon office sees its own blocks and cases, not other surgeons' patients.

Business associate agreement

Case schedules contain protected health information, and Moraph signs a business associate agreement with you.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, release, booking change, allocation decision and export is logged with the person and time, and cannot be edited.

AI proposes, people decide

Predictions and suggestions are shown with their basis; releases, bookings and allocations are made by people, and the models are monitored for accuracy.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• CMS Conditions of Participation for hospitals, surgical services (42 CFR 482.51)
• CMS Conditions for Coverage for ambulatory surgical centers (42 CFR Part 416, Subpart C)
• CMS Conditions of Participation for hospitals, quality assessment and performance improvement (42 CFR 482.21)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for health systems whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph's managed integration engine for interface monitoring and support.

Limitations

• The Optimizer does not replace your EHR's surgical scheduling module. Cases remain booked in the EHR, and the Optimizer works alongside it.
• Predictions and duration estimates are suggestions. Releases, bookings and allocations are decided by your staff and committee.
• Estimates depend on the completeness and accuracy of recorded case times. Surgeons and procedures with few past cases get wider ranges or no estimate.
• Whether released time is rebooked depends on demand and on your staff acting on suggestions; the Optimizer cannot guarantee that time will be used.
• Writing releases and booking changes back to the EHR depends on what your EHR's interfaces support; otherwise schedulers apply them from a task list.
• It does not schedule staff, anesthesia or equipment, although it uses staffed room hours where you provide them.
• It is not a clinical decision tool and does not assess patients' fitness for surgery.
• Block policy, allocation decisions and release deadlines are your organization's decisions; the Optimizer records and models them.