Security, data and compliance in Tumor Board Collaboration Platform

How Tumor Board Collaboration Platform protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Access follows role and board membership, so people see only the cases they are preparing or discussing.

Business associate agreement

Moraph signs a business associate agreement with you, because the platform handles protected health information.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, edit, sign-off, recommendation and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• American College of Surgeons Commission on Cancer, Optimal Resources for Cancer Care (2020 Standards)
• National Accreditation Program for Breast Centers (NAPBC) standards
• College of American Pathologists cancer protocols for synoptic reporting
• 21st Century Cures Act information blocking rule (45 CFR Part 171)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph managed services for clinical collaboration, single sign-on or integration engine support.

Limitations

• It does not make treatment decisions. Recommendations are made by your board and the treating physician remains responsible for the patient's care.
• Draft case summaries are proposals. The presenter must review and approve each summary, and the source record remains authoritative.
• It is not a PACS or a diagnostic viewer. Images and digital slides stay in and open from your existing systems.
• Pathology and imaging reports are not amended in the platform; corrections are made in the laboratory or radiology system.
• It is not cancer registry software. It provides conference data to your registry; abstraction and submission are done by your registrars.
• Accreditation reports present your data; meeting accreditation standards is your cancer program's responsibility.
• The case view is only as complete as the source systems connected during implementation.
• Online conferences use the meeting service you already have; the platform does not host video.