Security, data and compliance in Virtual Waiting Room & Intake

How Virtual Waiting Room & Intake protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person sees follows their role and clinic, applying the minimum necessary standard to clinical and financial information.

Business associate agreement

Moraph signs a business associate agreement with you, because the product handles protected health information.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, contact, payment and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• Section 1557 of the Affordable Care Act (45 CFR Part 92), language access and effective communication
• 21st Century Cures Act information blocking rule (45 CFR Part 171)
• Telephone Consumer Protection Act (47 U.S.C. 227), for text message reminders
• Payment Card Industry Data Security Standard (PCI DSS), met by your payment processor for card data

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph managed services for single sign-on, contact center or integration engine support.

Limitations

• It is not a video platform. Visits take place on the telehealth video service you already use.
• Moraph does not hold funds. Payments are processed and settled by your own payment processor, which holds card data.
• It does not schedule appointments; appointments come from your scheduling or practice management system.
• Eligibility results depend on your clearinghouse and the payers' responses, and estimates are only as accurate as the rates and benefits you configure.
• The device test checks the patient's equipment and connection at the time of the test. It cannot guarantee the connection during the visit.
• It does not provide interpreters; it flags the need so your language services can arrange one.
• Clinical content of forms and questionnaires is your organization's responsibility; Moraph configures what your clinical leads approve.
• Text message reminders depend on patients' consent and contact preferences, which your organization is responsible for collecting.