Security, data and compliance in Virtual Scribe

How Virtual Scribe protects data and supports your compliance obligations.

Security controls

Business associate agreement

Moraph signs a business associate agreement with your organization because the service involves PHI, and Nuance's own agreement covers the platform.

Named Moraph administrators

Moraph staff work with individual accounts, the least administrator rights the service needs and multi-factor authentication; there are no shared accounts.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Complete audit trail

Moraph's change and ticket records show who did what and when, alongside the platform's own administration logs.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. Nuance's own attestations cover the platform.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
• CMS Conditions of Participation for medical record services (42 CFR 482.24)
• Medicare Program Integrity Manual, Chapter 3, signature and documentation requirements
• State laws on consent to record conversations, where ambient documentation is used

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the Dragon subscription and runs it as one service, subject to Nuance's terms.
• Your existing Dragon licences: If you already license Dragon, Moraph reviews the current setup against a new baseline and takes over its operation.
• Co-managed: Your team keeps some tasks, such as first-line support or user setup, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not Nuance. Nuance operates the Dragon platform, and Nuance's own service commitments, roadmap, maintenance and outages apply.
• Dragon licences are subject to Nuance's terms. Ambient documentation and some other capabilities need their own licences.
• Speech recognition and ambient documentation produce text that can contain errors. The clinician must review, correct and sign every note.
• Moraph does not provide clinical documentation, coding or medical advice, and does not edit or sign notes on anyone's behalf.
• Consent rules for recording patient conversations vary by state. Your organization decides its consent and notice policy; Moraph helps document and apply it.
• EHR integration depends on what your EHR and Nuance support together. Some note fields or workflows may need manual steps.
• Recognition quality depends on microphones, network and workstation builds that your organization manages.
• Moraph does not make privacy or breach notification decisions; your privacy officer does.