Healthcare · Managed platform (Microsoft Teams)

Clinical Collaboration

Microsoft Teams set up and run for care teams, virtual visits and PHI

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph provisions Microsoft Teams for clinical use under a business associate agreement, configured for care team chat, virtual consults and the handling of protected health information. We set up the tenant controls, meeting policies, retention and guest access your privacy and security teams approve, and then run the environment as a managed service. Your clinicians use Teams; your organization keeps control of who can do what and of every policy decision.

The problem it solves

Many health systems already license Microsoft 365, and clinicians already use Teams, but often in a configuration built for office work rather than patient care. Guest access, external meetings, recording, file sharing and retention are set once by IT and rarely reviewed against HIPAA. Virtual visits run on a mix of tools, care team chats sit beside general staff chat, and when privacy asks where a recorded consult is stored or who could join a meeting with a patient, the answer takes days to assemble.

  • Teams settings were chosen for office collaboration, not for conversations that contain PHI
  • Virtual visits run on several tools with different controls and no common record
  • Guest access, recording and external sharing are not reviewed against privacy policy
  • Nobody owns the configuration day to day, so changes drift from what was approved

Who uses it

  • Health systems, hospitals and physician groups that license Microsoft 365
  • CMIOs, CNIOs and clinical informatics teams planning virtual care
  • Privacy and security officers who answer for PHI in collaboration tools
  • IT teams that want Teams run to a documented baseline without adding headcount
  • Ambulatory and behavioral health practices that offer video visits

Requirements it supports

HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)HIPAA Security Rule (45 CFR Part 164, Subpart C)HIPAA Breach Notification Rule (45 CFR 164.400-414)Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)Medicare telehealth services (42 CFR 410.78)State telehealth, consent and recording laws where your clinicians and patients are located

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Microsoft provides and operates Teams, Moraph configures and runs your clinical use of it, and your organization makes the privacy and clinical decisions.

AreaMoraphMicrosoftYour organization
LicensingResells Microsoft 365 and Teams licenses where agreed and advises on the licenses each feature needsSets license terms, product availability and what each license includesChooses and pays for licenses and assigns them to users
Business associate termsSigns a business associate agreement with you for Moraph's servicesProvides its own BAA terms for in-scope Microsoft services under your agreementConfirms its Microsoft agreement includes BAA coverage and decides which services may carry PHI
Platform availabilityMonitors service health, raises incidents with Microsoft and keeps you informedOperates Teams and Microsoft 365 under its own service commitmentsTells Moraph about clinical impact and runs downtime procedures
ConfigurationDesigns, applies and documents the clinical baseline and approved changesProvides the settings and policy controls available in the platformApproves the baseline and every change
Identity and accessConfigures Teams to use your directory groups and conditional access policiesProvides Microsoft Entra ID and its access controlsOwns the directory, joiner and leaver processes and multi-factor policy
MonitoringChecks configuration drift and service health and investigates problemsMonitors its platform and publishes service healthReports problems through the agreed service desk route
Incident responseLeads incident handling for the service and reports cause and fixResolves platform incidents and publishes post-incident information where availableDecides on breach assessment and any notification
Platform updatesReviews Microsoft notices for effects on your baseline and tells you about changesReleases and applies Teams updatesPrepares clinicians for changes that affect them
Policy decisionsRecommends settings and explains their effectNot involvedSets privacy, retention, recording and guest policy
User supportHandles escalated configuration and access issuesProvides vendor support to MoraphProvides first-line support to clinicians, unless agreed otherwise

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Microsoft Teams itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    During onboarding, each area of the clinical baseline moves from assessment to approval to applied, with the owner of each step visible.

    AreaAssessedBaseline draftedPrivacy approvalAppliedStatus
    Meeting and lobby policiesYesYesApprovedPilotIn pilot
    Guest and external accessYesYesApprovedYesLive
    Recording and transcriptionYesYesPendingNoWaiting on privacy officer
    Retention for chats and channelsYesYesApprovedYesLive
    Virtual visit templatesYesIn progressNot startedNoDrafting
    Mobile app protectionYesYesApprovedNoWaiting on client IT
    During onboarding, each area of the clinical baseline moves from assessment to approval to applied, with the owner of each step visible.

  2. Step 2

    Configuration baseline review

    Live settings are compared with the approved baseline, and every difference is corrected or explained.

    Clinical baseline · Example Health System (fictional)

    Baseline version
    1.4
    Settings checked
    186
    Matching
    183
    Differences
    3
    Last approved by
    Privacy officer

    Differences

    • Anonymous meeting join enabled on one policy, outside baseline
    • External chat allowed with one additional domain, change record found
    • Recording expiry changed on pilot policy, under review
    Live settings are compared with the approved baseline, and every difference is corrected or explained.

  3. Step 3

    A change request

    Changes that touch PHI handling are applied only after the privacy officer approves them, and the request stays with the change.

    Change CHG-1142 · Allow transcription for behavioral health visits

    Requested by
    Virtual care program lead
    Current setting
    Transcription off
    Requested setting
    Transcription on, stored with the meeting organizer
    Applies to
    Behavioral health visit template
    Retention
    Per approved schedule
    Status
    Awaiting privacy approval

    Approvals

    • Clinical informatics: approved
    • Client IT: approved
    • Privacy officer: pending, asked about 42 CFR Part 2 records
    Changes that touch PHI handling are applied only after the privacy officer approves them, and the request stays with the change.

  4. Step 4

    Alert triage

    Service alerts and drift findings are triaged by Moraph's service desk and worked to an owner.

    AlertSourceDescriptionSeverityOwnerStatus
    AL-5521Microsoft service healthMeeting join delays reported in regionHighMoraph service deskWatching, clinicians notified
    AL-5518Drift checkGuest policy differs from baselineMediumMoraph engineerInvestigating
    AL-5510Message centerUpcoming change to meeting recording defaultsMediumMoraph engineerAssessed, for review
    AL-5502Access reviewTeam with no active owner: 3 West nursingLowClinical informaticsOwner requested
    Service alerts and drift findings are triaged by Moraph's service desk and worked to an owner.

  5. Step 5

    Guest access review

    Guests in clinical teams are reviewed with team owners, and access that is no longer needed is removed.

    Guest access review · Cardiology teams

    1. Review opened: 14 guests across 4 teamsMoraph service team
    2. Team owners asked to confirm each guestMoraph service team
    3. 11 confirmed, 3 not neededTeam owners
    4. 3 guests removedMoraph service engineer
    5. Review signed offPrivacy officer
    Guests in clinical teams are reviewed with team owners, and access that is no longer needed is removed.

  6. Step 6

    Monthly service review

    Each service review brings changes, incidents, drift, reviews and risks together for IT, privacy and clinical leads.

    Service review · Example Health System (fictional)

    Changes applied
    12
    Incidents
    2, both closed
    Drift findings
    3, 1 open
    Guest reviews completed
    4 of 5
    Microsoft notices with impact
    2

    Decisions needed

    • Approve transcription for behavioral health visits
    • Agree retention for virtual visit recordings
    • Confirm owner for 3 West nursing team
    Each service review brings changes, incidents, drift, reviews and risks together for IT, privacy and clinical leads.

Workflows

The principal workflows

  1. Provision

    Moraph assesses your Microsoft 365 tenant, agrees a clinical configuration baseline with your privacy and security teams, and applies it to Teams and the services Teams depends on.

    • Tenant, licensing and current Teams settings reviewed
    • Business associate coverage confirmed for the Microsoft services in scope and for Moraph
    • Clinical baseline drafted: guest and external access, meetings, recording, files and retention
    • Baseline approved by your privacy officer and security lead
    • Settings applied in stages and tested with a pilot care team

  2. Collaborate

    Care teams work in Teams structured for clinical use: unit and service-line teams, care team chats, and channels with membership that follows your directory groups.

    • Clinical teams and channels created from an agreed template
    • Membership driven by directory groups for units, departments and roles
    • Sensitivity labels and sharing rules applied where your licensing supports them
    • Clinicians use chat, calls and files under the approved policies
    • Teams with no owner or no activity flagged for review

  3. Consult

    Virtual consults with patients and outside clinicians run as Teams meetings with policies for lobbies, guests, recording and transcription that your organization has approved.

    • Visit meeting templates configured with lobby and presenter settings
    • Patients join from a link without needing a Microsoft account
    • Recording and transcription allowed only where your policy permits
    • Where Teams Premium or Bookings is licensed, virtual appointment scheduling is configured
    • Clinical documentation stays in your EHR; Teams is the channel, not the record

  4. Run

    Moraph operates the environment day to day: monitoring configuration and service health, handling changes and access requests, and reporting on drift and use.

    • Service health and Microsoft message center notices reviewed for effect on your baseline
    • Change requests assessed, approved by you and applied
    • Configuration compared with the approved baseline and drift corrected or explained
    • Guest access and team ownership reviewed with your managers
    • Service review held with IT, privacy and clinical informatics

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Privacy officer

Privacy officer, HIPAA privacy officer, chief compliance officer

Decides how PHI may be handled in Teams and approves the settings and changes that affect it.

Sees

  • The approved clinical configuration baseline and its history
  • Change requests that affect guests, recording, retention or sharing
  • Drift findings and how each was resolved
  • Guest access and external sharing reports

Does

  • Approves the clinical baseline before it is applied
  • Approves or rejects changes that affect PHI handling
  • Decides retention periods for chats, channels and recordings with records management
  • Requests legal holds and privacy investigations through the service
  • Reviews service reports and open risks at each service review

Cannot

  • Change tenant settings directly through the Moraph service records
  • Approve a change they requested themselves when a second approver is required by your policy
Approvals
Approves the baseline and every change that touches guests, recording, transcription, retention or external sharing.
Notified about
Changes waiting for approval, drift findings involving PHI settings, privacy-relevant incidents, and guest access reviews coming due.

Clinical informatics lead

CMIO, CNIO, clinical informatics manager, virtual care program lead

Shapes how care teams and virtual visits use Teams so the setup fits clinical work.

Sees

  • Team and channel templates for clinical units and programs
  • Virtual visit meeting templates and their settings
  • Adoption and use reports by unit and service line

Does

  • Defines team structures and naming for clinical units
  • Requests new clinical teams, templates and visit types
  • Agrees virtual visit workflows with clinical leaders
  • Takes clinician feedback to service reviews
  • Coordinates clinician training with your education team

Cannot

  • Approve changes to guest, recording or retention settings without the privacy officer
  • Grant tenant administration rights
Approvals
Approves clinical templates and team structures; settings that affect PHI also need the privacy officer.
Notified about
Requests they raised moving through approval, planned changes that affect clinicians, and service review reports.

Client IT administrator

Microsoft 365 administrator, collaboration services manager, identity administrator

Owns the tenant, licenses and directory, and is the technical counterpart to Moraph's service team.

Sees

  • All Moraph change records and configuration documentation
  • Moraph's administrative access to the tenant and its activity
  • Service health, incidents and Microsoft notices affecting the service

Does

  • Grants and reviews the administrative roles Moraph uses
  • Manages licensing and directory groups that drive team membership
  • Approves technical changes and schedules them around clinical operations
  • Coordinates with your identity, device and network teams
  • Works incidents with Moraph where your systems are involved

Cannot

  • Approve changes that affect PHI handling without the privacy officer
  • Remove the audit records of Moraph's administrative actions
Approvals
Approves technical changes and Moraph's administrative access; PHI-related changes also need the privacy officer.
Notified about
Incidents, Microsoft notices with impact on your tenant, scheduled changes and access reviews for Moraph's roles.

Clinician or care team member

Physicians, nurses, advanced practice providers, therapists, care coordinators

Uses Teams to talk with colleagues and patients under the policies your organization approved.

Sees

  • Teams, channels and chats they are a member of
  • Virtual visit meetings they host or join
  • Files shared in their teams under the sharing rules that apply

Does

  • Chats and calls with care team members
  • Hosts virtual visits and admits patients from the lobby
  • Shares files within their teams
  • Raises requests and problems through your service desk

Cannot

  • Change meeting, guest, recording or retention policies
  • Invite guests or external participants beyond what policy allows
  • Delete content that a retention policy or hold requires to be kept
Approvals
Requests for new teams, guests or exceptions go to the owners your process names.
Notified about
Teams notifications they choose, and notices of planned changes that affect them.

Moraph service team

Moraph service engineer, service delivery manager, Moraph service desk

Configures, monitors and maintains the Teams environment for you, on approved requests and to the documented baseline.

Sees

  • Tenant configuration for Teams and the services it depends on
  • Service health, Microsoft notices and drift findings
  • Change, access and incident records for your service

Does

  • Applies the approved baseline and approved changes
  • Monitors configuration drift and service health
  • Handles access, guest and team requests through the approved route
  • Leads incident handling for the service and escalates to Microsoft
  • Prepares service review reports
  • Maintains configuration documentation

Cannot

  • Read chats, files or recordings as part of routine operations
  • Apply a change without the approvals your process requires
  • Use administrative access outside approved, time-bound work
Approvals
Every change Moraph applies is approved by your named approvers; emergency changes are reviewed with you afterwards.
Notified about
Service health alerts, drift findings, new requests and approvals, and Microsoft notices that affect your configuration.

Auditor (read-only)

Internal auditor, compliance reviewer, external assessor under temporary access

Reviews evidence that Teams is configured and run as approved, without changing anything.

Sees

  • The approved baseline and its version history
  • Change, access review and drift records
  • Service review reports

Does

  • Reads and exports evidence within the scope granted
  • Leaves review notes where enabled

Cannot

  • Change, approve or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the privacy officer or IT administrator, with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionPrivacyInformaticsClient ITClinicianMoraph teamAuditor
Approve the clinical baselineApprovesView onlyApprovesNo accessView onlyView only
Apply tenant and Teams settingsNo accessNo accessApprovesNo accessFullNo access
Change guest, recording or retention policyApprovesView onlyApprovesNo accessFullNo access
Request new clinical teams or templatesFullFullFullOwn work onlyView onlyNo access
Host virtual visitsNo accessNo accessNo accessFullNo accessNo access
Invite guests within policyNo accessNo accessView onlyOwn work onlyFullNo access
Apply legal holdsApprovesNo accessView onlyNo accessFullNo access
Review guest access and team ownershipApprovesView onlyFullNo accessFullView only
View drift findingsView onlyView onlyView onlyNo accessFullView only
View change and access recordsView onlyView onlyView onlyNo accessFullView only
Manage Moraph's administrative accessView onlyNo accessFullNo accessNo accessView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Roles here describe who decides what in the service. In Teams itself, your users have ordinary Microsoft 365 roles, and Moraph's engineers hold only the administrative roles your IT team grants.
  • Moraph does not decide privacy policy. Settings that affect PHI, guests, recording, transcription or retention change only with your privacy officer's approval.
  • Moraph's administrative access is reviewed with your IT administrator, used only for approved, time-bound work, and recorded with the request it served.
  • Auditors and assessors get temporary read-only access to service records with a defined scope and an end date, rather than shared accounts.

Features

What it does

Clinical configuration baseline

A documented set of Teams, meeting, guest, file and retention settings for clinical use, approved by your privacy and security leads and kept under change control.

Business associate coverage

Moraph signs a business associate agreement with you, and we confirm that the Microsoft services carrying PHI are covered by Microsoft's own BAA terms for your agreement.

Virtual visit meetings

Teams meeting templates for patient visits, with the lobby, presenter, chat and recording settings your policy sets, and browser join for patients.

Care team structure

Teams and channels by unit, service line or program, created from templates, with membership driven by your directory groups.

Guest and external access controls

Who can invite outside clinicians, which external organizations can chat with your staff, and how guest access is reviewed and expired.

Recording and transcript governance

Where recordings and transcripts are stored, who can see them, and how long they are kept, configured to your policy and documented.

Retention and holds

Retention policies for chats, channels and recordings set in Microsoft Purview to your schedule, with legal holds applied on request from your legal team.

Sensitivity labels and sharing rules

Where your licensing includes them, labels and sharing restrictions applied to clinical teams and files so PHI is not shared outside approved groups.

Conditional access and device policy

Sign-in conditions and app protection for Teams on phones and shared workstations, configured through Microsoft Entra ID and Intune where licensed.

Configuration drift monitoring

Regular comparison of live settings against the approved baseline, with every difference corrected or explained and recorded.

Change and access requests

A single route for new teams, policy changes, guest requests and exceptions, each with your approver recorded.

Service reviews

Regular reviews of use, changes, incidents, drift and open risks with your IT, privacy and clinical informatics leads.

Integrations

How it connects to your systems

Connects toHowWhat flows
Microsoft Entra IDSign-in, multi-factor authentication, conditional access and the groups that drive team membership, managed in your tenant.In: users, groups and sign-in policy from your directory.
Microsoft PurviewRetention, holds, sensitivity labels and audit search for Teams content, configured where your licensing includes them.Within your tenant: retention labels, holds and audit records.
Microsoft IntuneApp protection and device policies for Teams on phones, tablets and shared clinical workstations, where licensed.Within your tenant: device and app protection policy.
Electronic health recordWhere your EHR vendor supports launching Teams visits from the scheduled appointment, Moraph configures the Teams side and works with your EHR team on the rest.In: visit links and appointment context, as your EHR integration supports.
Microsoft Bookings and virtual appointmentsScheduling of patient virtual appointments and reminders, where your licensing includes them.Within your tenant: appointments and patient contact details you choose to use.
Your service deskRequests and incidents raised by your staff can be routed to Moraph's service desk, or Moraph's records linked to your own tool.In and out: tickets, status and resolution notes.
Security monitoringTeams and Microsoft 365 audit events can be forwarded to your security information and event management tool.Out: audit and sign-in events, through Microsoft's export options.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff sign in through Microsoft Entra ID under your multi-factor and conditional access policies, and Moraph's staff sign in to Moraph systems through Moraph's own identity provider.

Role-based access

Clinicians see the teams they belong to, and Moraph's service team works on configuration rather than content.

Controlled privileged access

Moraph's administrative roles in your tenant are granted by your IT team, used only for approved work, and keys and credentials cannot be used without explicit, time-bound authorization.

Complete audit trail

Every change Moraph makes is recorded in the service records with the request and approval behind it, and Microsoft's audit log records actions in the tenant.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own compliance reports for Microsoft 365 are available from Microsoft under its terms.

Data residency

Teams content stays in the Microsoft 365 data location of your tenant, and Moraph's service records are held in the United States, United Kingdom or Australia region you choose.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Configuration and change

Baseline compliance

For privacy officer, client IT

Each setting in the approved clinical baseline, its live value, and any difference found at the last check with its resolution.

Break down by
Policy area, Setting, Result, Resolution
Delivered as
Live view; PDF export
Used for
Showing that Teams is configured as approved.

Change log

For client IT, privacy officer, auditors

Every change applied to the environment with its request, approvers, date and outcome.

Break down by
Change type, Requester, Approver, Period
Delivered as
Live view; CSV and PDF export
Used for
Evidencing that changes followed the approval route.

Microsoft notices with impact

For client IT, clinical informatics

Microsoft service notices and upcoming feature changes assessed for their effect on your baseline, with Moraph's recommendation.

Break down by
Impact, Service, Action needed, Status
Delivered as
Service review pack; email
Used for
Preparing clinicians and approvers for changes Microsoft makes to the platform.

Access and sharing

Guest access review

For privacy officer, team owners

Guests in each team, who invited them, when they last signed in, and whether access was kept or removed at review.

Break down by
Team, Guest organization, Last sign-in, Review outcome
Delivered as
Live view; CSV export
Used for
Removing guest access that is no longer needed.

Team ownership and activity

For clinical informatics, client IT

Teams without an active owner, teams with no recent activity, and teams due for review.

Break down by
Department, Owner status, Activity, Template
Delivered as
Live view; CSV export
Used for
Keeping the team structure tidy and accountable.

Moraph administrative access

For client IT, auditors

The administrative roles Moraph holds in your tenant, who holds them, and when each was last reviewed.

Break down by
Role, Engineer, Review date
Delivered as
Live view; PDF export
Used for
Periodic certification of Moraph's access.

External sharing and recording settings

For privacy officer

Where external sharing, recording and transcription are allowed, by policy and group, and any exceptions granted.

Break down by
Policy, Group, Exception, Approver
Delivered as
Live view; PDF export
Used for
Confirming PHI-related settings match privacy policy.

Service

Incidents

For client IT, service review attendees

Incidents affecting the service, their cause, who resolved them, and any follow-up actions.

Break down by
Severity, Cause, Owner, Period
Delivered as
Service review pack; CSV export
Used for
Understanding what went wrong and whether it has been fixed.

Requests and backlog

For client IT, clinical informatics

Requests received, completed and open, by type and age.

Break down by
Request type, Requester department, Age, Status
Delivered as
Live view; service review pack
Used for
Seeing what is waiting and where approvals are holding work up.

Virtual visit use

For clinical informatics, virtual care program

Visit meetings held by department and template, drawn from Teams usage reporting, without clinical content.

Break down by
Department, Template, Period
Delivered as
Service review pack; CSV export
Used for
Planning virtual care capacity and training.

Service review summary

For iT, privacy and clinical leadership

A summary of changes, incidents, drift, access reviews and open risks for the period.

Break down by
Period, Area
Delivered as
PDF; scheduled email
Used for
Giving leadership one view of how the environment is being run.

Exports, access and evidence

  • Service reports are produced from Moraph's change, access, incident and drift records, and can be exported to CSV and PDF.
  • Use figures come from Microsoft's Teams and Microsoft 365 usage reporting, so they are subject to what Microsoft reports and how long it keeps that data.
  • Reports contain configuration and activity data, not the content of chats, files or recordings.
  • Reports respect each viewer's role: clinicians see none of them by default, and auditors see evidence reports within their scope.
  • Service review packs are kept with the service records so earlier periods can be revisited.

Deployment

Where and how it runs

Your Microsoft 365 tenant, managed by Moraph

Teams runs in your organization's tenant; Moraph configures and operates it for you under a managed service agreement.

With licenses bought through Moraph

Moraph resells the Microsoft licenses you need and manages them alongside the service, subject to Microsoft's terms.

Alongside other Moraph services

Run with Moraph's Secure Messaging, Single Sign-On or Identity Governance services so clinical communication and access are managed together.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Tenant assessment

We review your Microsoft 365 tenant, licensing, current Teams settings and how clinicians use Teams today. We need administrative read access and a contact from your Microsoft 365 team.

Business associate review

We confirm BAA coverage for the Microsoft services in scope and put Moraph's own business associate agreement in place before we handle any PHI.

Clinical baseline

We draft the clinical configuration baseline with your privacy, security and clinical informatics leads, and they approve it before anything changes.

Pilot

The baseline is applied to a pilot group, such as one unit or virtual care program, and adjusted from what clinicians and privacy find.

Rollout

Settings and team templates are applied across the organization in stages you schedule around clinical operations, with communications for clinicians.

Handover to run

Service desk routes, approvers, review cycles and reporting are agreed, and the environment moves into managed service.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Microsoft. Teams and Microsoft 365 belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
  • Licenses are subject to Microsoft's terms, and some controls described here, such as sensitivity labels, advanced retention or virtual appointment features, depend on the licenses you hold.
  • Business associate coverage for Microsoft services comes from your agreement with Microsoft. Moraph's BAA covers Moraph's services, not Microsoft's.
  • Teams is a communication tool, not your medical record. Clinical documentation, orders and results belong in your EHR.
  • Moraph does not make privacy, retention or clinical policy decisions. Your organization approves them and remains responsible for HIPAA compliance.
  • Patient-side experience depends on the patient's device, browser and connection, which neither Moraph nor Microsoft controls.
  • State telehealth, licensure, consent and recording rules vary, and legal advice on them is not part of the service.
  • Moraph does not routinely read chats, files or recordings, so the service does not detect inappropriate content unless you configure and review tools for that purpose.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Ask for a sample clinical baseline and compare it with your current Teams settings
  2. Confirm which baseline controls your current Microsoft licenses support
  3. Walk through a change request that affects recording or guests and check who approves it
  4. Review how Moraph's administrative access to your tenant is granted, logged and reviewed
  5. Run a test virtual visit with a patient joining from a browser on a phone
  6. Review a sample service review pack with your privacy officer

Questions

Frequently asked questions

We already have Microsoft 365. Do we need new licenses?

Not necessarily. Moraph starts from what you license and tells you which features in the baseline need additional licenses, so you can decide whether they are worth adding.

Who signs the business associate agreement?

Moraph signs one with you for Moraph's services. Coverage for Microsoft's services comes from Microsoft's own terms under your Microsoft agreement, and we confirm it is in place during onboarding.

Does Moraph read our chats or recordings?

Not as part of routine operations. Moraph's team works on configuration and service health. Content is accessed only on a logged request from your privacy or legal team, such as a hold or investigation.

Can patients join a visit without installing Teams?

Yes. Teams meetings can be joined from a web browser, and the visit templates are configured for that. The patient's device and connection still affect the experience.

Who decides whether visits can be recorded?

Your organization. Moraph configures recording and transcription as your privacy officer approves and documents where recordings are kept and for how long.

How is it priced?

As a managed service, usually based on the number of users and the scope of services, with licenses and onboarding quoted separately. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Clinical Collaboration

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Clinical Collaboration guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Clinical Collaboration support guide.

Related products