Security, data and compliance in Visitor Management

How Visitor Management protects data and supports your compliance obligations.

Security controls

Data you choose to collect

Each sign-in flow collects only what your privacy officer approves; by default the patient being visited is not recorded.

Business associate agreement

Where visit records include patient information, Moraph signs a business associate agreement and patient details are only recorded where Envoy's terms allow it.

Role-based access

Desk officers see their entrance, hosts see their guests, and the full visit log is limited to the roles you choose.

Complete audit trail

Envoy records sign-ins and administrator actions, and Moraph's change record links each change to its request and approval.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. Envoy's own attestations cover the platform.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• CMS Conditions of Participation, patient visitation rights (42 CFR 482.13(h))
• The Joint Commission Environment of Care standard EC.02.01.01 and workplace violence prevention requirements
• OSHA General Duty Clause (Section 5(a)(1) of the Occupational Safety and Health Act)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the Envoy subscription and runs it as one service, subject to Envoy's terms.
• Your existing Envoy account: If you already license Envoy, Moraph reviews the current setup against a new baseline and takes over its operation.
• Co-managed: Your team keeps some tasks, such as watchlist entry or first-line device support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not Envoy. Envoy operates the platform, and Envoy's own service commitments, roadmap, maintenance and outages apply.
• Envoy licences are subject to Envoy's terms. Kiosk tablets, printers, scanners and some integrations are priced separately.
• Moraph does not staff entrances or provide security officers. Your staff sign visitors in and respond to alerts.
• Watchlist checks only find people on your watchlist. The service does not perform criminal background checks.
• Health screening relies on the answers visitors give. It is not a clinical assessment, and your infection prevention team decides the questions.
• Access control and vendor credentialing integrations depend on what Envoy supports with your systems.
• Visitors who bypass a staffed or kiosk entrance are not recorded. Physical entrance control is your organization's responsibility.
• Moraph does not make privacy or breach notification decisions; your privacy officer does.