Healthcare · Managed platform (Box for Healthcare)

Cloud Content

Store, share and govern research papers, policies and other documents that may hold PHI, with Box run by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Box for Healthcare as the place your organization keeps unstructured content: research files, policies, committee papers and documents shared with partners. We configure Box for your folder structure, sharing rules, classification and retention, move content in from file shares, and handle administration and support. Box provides the platform under its business associate agreement with you; Moraph operates it under ours; your organization decides who may see and share what.

The problem it solves

Healthcare organizations keep large amounts of content outside the EHR: research data and papers, policy and procedure documents, committee minutes, contracts and files exchanged with partners. Much of it sits on aging file shares, in personal cloud accounts or in email attachments, where nobody can say who has access, what holds patient information, or how long it is kept. A HIPAA-capable content platform helps only when it is configured with sensible sharing rules, retention and classification, and when someone looks after it day to day.

  • Documents that may contain PHI are spread across file shares, email and personal accounts
  • External sharing with researchers and partners is hard to see and harder to revoke
  • Retention and legal holds are applied by hand, if at all
  • Nobody owns day-to-day administration, access reviews and user support

Who uses it

  • IT and infrastructure leaders at hospitals, health systems and academic medical centers
  • Research administrators and investigators who share files with outside collaborators
  • Privacy and compliance officers responsible for where PHI is stored and shared
  • Records managers and legal teams who set retention and legal holds
  • Policy and quality teams who publish and maintain controlled documents

Requirements it supports

HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)HIPAA Security Rule (45 CFR Part 164, Subpart C)HIPAA Breach Notification Rule (45 CFR 164.400-414)HITECH ActFederal Policy for the Protection of Human Subjects (Common Rule, 45 CFR Part 46)21 CFR Part 11, for research records where it applies

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Box provides and supports the content platform, Moraph configures, administers and supports it for you, and your organization owns the content and the decisions about access, sharing and retention.

AreaMoraphBoxYour organization
LicensingResells Box licences and add-ons sized to your users and needs, and tracks renewalsSets licence terms, entitlements and storage limitsApproves the licence scope and the users covered
Business associate agreementsSigns a business associate agreement with you for its administration and supportSigns its own business associate agreement with you for the Box serviceSigns both agreements and decides what PHI may be stored
Platform availabilityMonitors service status and raises platform issues with BoxOperates the Box service under its own service commitmentsProvides network access and supported devices for your staff
ConfigurationConfigures enterprise settings, sharing rules, classification labels and folder structure, and documents every versionProvides the settings, security features and add-ons in the platformDecides sharing rules, classification and who may create top-level folders
Identity and accessConnects Box to your identity provider, maps groups to folders and runs periodic access reviewsProvides single sign-on, user provisioning and permission featuresOwns your identity provider and approves who may access each area
Retention and legal holdsConfigures retention policies and holds as your records and legal teams direct, where licensedProvides retention and legal hold featuresDecides retention periods and when holds are placed and released
Monitoring and incidentsReviews security alerts and unusual activity, and escalates under the agreed runbookGenerates events and alerts and supports platform defectsDecides whether an event is a breach and makes any notification
Changes and updatesReviews Box release notes, tests changes that affect your configuration and applies them after approvalReleases new features and changes to the serviceApproves configuration changes and communicates them to staff
MigrationPlans and runs content moves from file shares and other repositoriesProvides migration tools and interfacesDecides what moves, what is archived and what is deleted
User supportAnswers your service desk and folder owners on access, sharing, restores and syncSupports Moraph on product issuesRuns your service desk and staff training

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Box for Healthcare itself, which belongs to its vendor.

  1. Step 1

    Onboarding and migration tracker

    Onboarding and each migration wave are tracked with an owner, so decisions on your side are visible.

    TaskOwnerStatus
    Business associate agreements signedYour privacy officerDone
    Single sign-on and provisioning connectedMoraph administratorDone
    Sharing rules approvedYour privacy officerDone
    Wave 1: Research Office file shareMoraph administratorIn progress
    Retention schedule mapped to policiesYour records managerWaiting
    Folder owner trainingYour service ownerNot started
    Onboarding and each migration wave are tracked with an owner, so decisions on your side are visible.

  2. Step 2

    Configuration baseline review

    Moraph walks your service owner and privacy officer through the configuration baseline and records the decisions still open.

    Configuration baseline · Example Health System (fictional)

    Users in scope
    6,200
    Top-level areas
    38
    Default shared link access
    People in your organization
    Outside collaborators on PHI-labeled folders
    Approved exceptions only
    Retention policies
    Pending records schedule
    Box Drive on unmanaged devices
    Blocked

    Decisions needed

    • Confirm the expiry for shared links to outside collaborators
    • Name folder owners for the remaining 4 areas
    • Approve the label for research data without PHI
    Moraph walks your service owner and privacy officer through the configuration baseline and records the decisions still open.

  3. Step 3

    Sharing exception request

    A request to share outside the rules goes to your privacy officer, and the exception ends on the date set.

    SE-0417 · Share a PHI-labeled study folder with Example University (fictional)

    1. Exception requested with the data use agreement attachedFolder owner
    2. Folder contents and collaborators reviewedMoraph administrator
    3. Exception approved with an end date at study closeYour privacy officer
    4. Two outside collaborators added as viewersFolder owner
    5. Review reminder scheduled for the end dateMoraph administrator
    A request to share outside the rules goes to your privacy officer, and the exception ends on the date set.

  4. Step 4

    Security alert triage

    Unusual activity is reviewed by Moraph under the runbook, and anything that may involve PHI goes to your privacy officer.

    BX-2291 · Large download from a PHI-labeled folder

    User
    Staff User 3318 (fictional)
    Folder
    Quality Committee / Case Reviews
    Files downloaded
    412 in 20 minutes
    Device
    Not a managed device
    Folder owner contacted
    Yes, no business reason known
    Runbook action
    User sessions ended, access suspended

    Next steps

    • Escalated to your privacy officer as possibly involving PHI
    • Download activity exported for the investigation
    • Access restored only on your service owner's decision
    Unusual activity is reviewed by Moraph under the runbook, and anything that may involve PHI goes to your privacy officer.

  5. Step 5

    Monthly service review

    Each month Moraph reviews requests, alerts, sharing and changes with your service owner and brings the decisions that are due.

    Monthly service review · sample month

    Requests resolved
    184
    Restores completed
    23
    Security alerts reviewed
    11
    Escalated as possible PHI
    1
    Sharing exceptions ending this month
    3
    Licences unused for 90 days
    57

    Decisions needed

    • Approve the move of the Policy Library to Box
    • Decide whether to reclaim unused licences before renewal
    • Approve a new label for contracts
    Each month Moraph reviews requests, alerts, sharing and changes with your service owner and brings the decisions that are due.

  6. Step 6

    Outside collaborator review

    Folder owners confirm or remove outside collaborators on a regular cycle, and Moraph removes what they decline.

    FolderCollaboratorAccessLast activityDecision
    Study 2207 (fictional)Researcher at Example UniversityViewerThis weekKeep
    Study 2207 (fictional)Coordinator at Example CROEditorLast monthKeep
    Grant Office / SubmissionsConsultant at Example AdvisorsEditorNo activity in 6 monthsRemove
    Facilities / ProjectsContractor at Example BuildersViewerLast weekKeep until project end
    Folder owners confirm or remove outside collaborators on a regular cycle, and Moraph removes what they decline.

Workflows

The principal workflows

  1. Organize

    Content is arranged in a folder structure agreed with you, with each top-level area owned by a department or project and access granted through groups from your identity provider.

    • Top-level areas agreed for departments, research projects and shared functions
    • Each area has a named folder owner in your organization
    • Access granted by group, with Box collaboration roles such as editor or viewer
    • Classification labels applied by default to areas likely to hold PHI, where licensed
    • New areas requested through the service desk and created by Moraph

  2. Share

    Staff share files and folders with colleagues and approved outside collaborators within the rules your privacy officer sets, and folder owners can see and revoke what has been shared.

    • Folder owner invites an outside collaborator to a project folder
    • Box applies the sharing rules for the folder's classification
    • Shared links follow your defaults for who can open them and when they expire
    • Exceptions to the rules go to your privacy officer for approval
    • External collaborators reviewed periodically and removed when a project ends

  3. Govern

    Retention policies and legal holds are configured in Box as your records and legal teams direct, so content is kept for as long as required and no longer.

    • Records manager sets retention periods by content type or folder
    • Moraph configures retention policies in Box, where licensed
    • Legal holds placed on people or folders when your legal team asks
    • Content reaching the end of retention handled as the policy directs
    • Policy and hold changes recorded with who approved them

  4. Support and monitor

    Moraph handles requests from your service desk and folder owners, reviews security alerts and unusual activity, and meets you monthly to review the service.

    • Requests for access, restores and new folders arrive through your service desk
    • Security alerts such as unusual downloads reviewed under the runbook
    • Events that may involve PHI escalated to your privacy officer
    • Access and external collaborator reviews run on the agreed cycle
    • Monthly service report reviewed with your service owner

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Service owner

IT director, infrastructure manager, collaboration services lead

Owns the Box service for your organization and decides how it is configured and supported.

Sees

  • Enterprise configuration and its version history
  • Usage, storage and licence reports
  • Open requests and incidents
  • Monthly service reports

Does

  • Approves configuration changes
  • Approves the folder structure and who may create top-level areas
  • Reviews the monthly service report with Moraph
  • Agrees the support runbook and escalation routes
  • Approves licence changes

Cannot

  • Apply configuration changes directly; Moraph applies approved changes
  • Open content in other people's folders by virtue of this role
Approvals
Approves configuration changes; changes affecting sharing or classification also need the privacy officer.
Notified about
Changes waiting for approval, service notices from Box and escalated incidents.

Privacy officer

HIPAA privacy officer, chief privacy officer, research compliance officer

Decides how content that may contain PHI is classified and shared, and whether events are reportable breaches.

Sees

  • Sharing rules, classification labels and exceptions
  • Outside collaborator lists by folder
  • Security alerts escalated as possibly involving PHI
  • Legal holds in place

Does

  • Sets sharing and classification rules
  • Approves or declines exceptions to sharing rules
  • Reviews escalated events and records breach determinations
  • Asks for legal holds with your legal team
  • Authorizes access to content for an investigation

Cannot

  • Apply configuration changes directly
  • Change retention periods set by the records manager
Approvals
Approves sharing exceptions and any change to sharing or classification rules; their own exception requests need a second approver you name.
Notified about
Sharing exceptions requested, events escalated as possibly involving PHI, and holds placed or released.

Records manager

Records manager, health information management director, legal operations lead

Decides how long content is kept and makes sure retention and holds are applied as decided.

Sees

  • Retention policies and the folders they apply to
  • Legal holds and their scope
  • Content approaching the end of retention

Does

  • Sets retention periods by content type or folder
  • Requests retention policy changes
  • Works with legal to scope holds
  • Reviews disposition of content at the end of retention

Cannot

  • Configure Box directly
  • Release a legal hold without your legal team's decision
Approvals
Retention changes follow your records policy; Moraph applies them only on the records manager's written request.
Notified about
Content reaching the end of retention and changes to holds.

Folder owner

Department manager, principal investigator, research coordinator, policy lead

Looks after a department or project area: who has access, what is shared and with whom.

Sees

  • Their own folders, collaborators and shared links
  • Outside collaborator review lists for their folders
  • Activity on their folders

Does

  • Invites colleagues and approved outside collaborators within the sharing rules
  • Removes collaborators when they no longer need access
  • Confirms access in periodic reviews
  • Restores their own deleted files within the recovery period
  • Requests exceptions and new folders through the service desk

Cannot

  • Share outside the rules for the folder's classification without an approved exception
  • Change retention or holds on their content
  • Access areas they do not own or collaborate on
Approvals
Exceptions to sharing rules are approved by the privacy officer.
Notified about
Access reviews due, sharing exceptions decided and alerts about their folders.

Moraph Box administrator

Moraph collaboration platform engineer, Box administrator

Configures and administers Box so it reflects your decisions.

Sees

  • Enterprise settings, users, groups and folder structure
  • Admin console reports and event logs
  • Box release notes and service notices

Does

  • Configures settings, sharing rules, labels, retention and holds as approved
  • Manages users, groups and top-level folders
  • Plans and runs migrations
  • Applies approved changes and records each version
  • Raises platform issues with Box support

Cannot

  • Open file content without your explicit, time-bound authorization
  • Apply a configuration change without approval
  • Place or release a legal hold on its own decision
Approvals
Every configuration change is approved by your service owner, and sharing or classification changes also by your privacy officer.
Notified about
Approved changes ready to apply, migration issues and Box service notices.

Moraph support analyst

Moraph service desk analyst, security operations analyst

Handles day-to-day requests and reviews security alerts under the agreed runbook.

Sees

  • Service desk requests and their history
  • Security alerts and the activity behind them
  • File and folder names, but not content

Does

  • Resolves access, sync and sharing questions
  • Restores deleted files and earlier versions on request
  • Reviews unusual activity alerts and contacts the folder owner
  • Suspends a user's access under the runbook when activity looks malicious
  • Escalates events that may involve PHI to your privacy officer

Cannot

  • Change configuration
  • Open file content
  • Make breach determinations
Approvals
Actions beyond the runbook, such as removing a collaborator from a research folder, need the folder owner's or service owner's approval.
Notified about
New requests, security alerts and replies to their escalations.

Auditor (read-only)

Internal auditor, external auditor, compliance reviewer

Reviews configuration, access and activity without being able to change anything.

Sees

  • Configuration and change history
  • Access review results and outside collaborator lists
  • Activity reports and the audit trail within the scope granted

Does

  • Searches and reads records within their scope
  • Exports reports they have been given access to, with each export logged

Cannot

  • Change, approve or delete anything
  • Open file content
  • Keep access after it expires
Approvals
Their access is approved by the service owner, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

ActionService ownerPrivacyRecords mgrFolder ownerMoraph adminMoraph supportAuditor
Propose a configuration changeFullFullFullFullFullFullNo access
Approve a configuration changeApprovesApprovesNo accessNo accessNo accessNo accessNo access
Apply configuration changesNo accessNo accessNo accessNo accessFullNo accessNo access
Create top-level foldersApprovesNo accessNo accessNo accessFullNo accessNo access
Invite collaboratorsNo accessNo accessNo accessOwn work onlyNo accessNo accessNo access
Approve a sharing exceptionNo accessApprovesNo accessNo accessNo accessNo accessNo access
Set retention periodsView onlyView onlyFullNo accessNo accessNo accessView only
Place or release a legal holdNo accessApprovesView onlyNo accessFullNo accessNo access
Restore deleted contentNo accessNo accessNo accessOwn work onlyFullFullNo access
Review security alertsView onlyView onlyNo accessOwn work onlyFullFullNo access
Manage users and groupsApprovesNo accessNo accessNo accessFullNo accessNo access
View audit trailView onlyView onlyView onlyOwn work onlyView onlyView onlyView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph administers Box without reading your content: Moraph staff see file and folder names and activity, and open content only with your explicit, time-bound authorization, which is logged.
  • Folder owners in your organization control everyday access to their areas, within the sharing rules your privacy officer sets; Moraph does not grant access to a folder without its owner or your service owner.
  • Nobody approves their own change or exception. Configuration changes are approved by your service owner, and sharing or classification changes also by your privacy officer.
  • Access to Box follows your identity provider's groups, and access and outside collaborator reviews run on the cycle you set. Auditors get temporary read-only access with a scope and an end date.

Features

What it does

HIPAA-capable storage

Box for Healthcare is offered with a business associate agreement from Box, and Moraph configures it with the settings your organization needs to store PHI.

Folder structure and ownership

Top-level areas for departments and projects, each with a named owner, and access granted through groups rather than individual invitations.

Sharing rules

Box enforces your defaults for shared links and outside collaborators, such as who may open a link and whether it expires.

Classification labels

Box Shield labels mark content such as PHI or research data and apply stricter sharing and download rules to it, where licensed.

Unusual activity alerts

Box Shield raises alerts for activity such as large downloads or suspicious sign-ins, reviewed by Moraph under your runbook, where licensed.

Retention and legal holds

Box Governance applies retention policies and legal holds that your records and legal teams decide, where licensed.

Version history and recovery

Box keeps file versions and deleted content for the periods your settings allow, and Moraph restores content on request.

Outside collaborator review

Periodic lists of outside collaborators by folder for owners to confirm or remove, so access ends when projects do.

Migration from file shares

Moraph plans and runs moves from file shares and other repositories, with your teams deciding what moves, what is archived and what is deleted.

Desktop and mobile access

Box Drive and the Box mobile apps configured with your device rules, so staff work with files without keeping uncontrolled copies.

Office editing

Documents opened and edited with Microsoft 365 or Google Workspace from Box, where your organization uses them.

Administration as a service

User, group and folder administration, access requests and restores handled by Moraph through your service desk.

Integrations

How it connects to your systems

Connects toHowWhat flows
Single sign-on and provisioningStaff sign in to Box through your identity provider (SAML), and accounts and groups are provisioned from it.In: user identity, account status and group membership.
File shares and other repositoriesContent moved from network file shares and other repositories during migration, with folder permissions mapped where possible.In: files, folders and their permissions.
Microsoft 365 or Google WorkspaceDocuments stored in Box opened and edited in the office tools your organization uses.In and out: documents opened for editing and saved back to Box.
SIEMBox events such as sign-ins, downloads, sharing changes and admin actions forwarded to your security information and event management system.Out: user and admin activity events.
Device managementBox Drive and mobile apps deployed and controlled through your mobile device management tools.In: device status used by device rules, where configured.
Service deskAccess requests, restores and incidents flow between Moraph and your IT service management tool.In and out: tickets, status and resolution notes.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Administration, support and folder ownership are separate roles, and Moraph's administrators do not open your content without authorization.

Business associate agreements

Moraph signs a business associate agreement with you for its administration and support, alongside your agreement with Box for the Box service.

Encryption and keys

Box encrypts content as part of its service, and Moraph staff cannot use their administrative access to reach content without your explicit, time-bound authorization.

Complete audit trail

Every configuration change, access grant, restore and authorized content access by Moraph is logged with the person and time.

Data residency

Records Moraph keeps about the service stay in the hosting region you choose: the United States, the United Kingdom or Australia. Where Box stores content follows your Box agreement.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Requests and restores

For service owner and service desk lead

Access requests, restores, new folder requests and other tickets, with status and time open.

Break down by
Request type, Status, Department, Age
Delivered as
Live view in Moraph's service portal; CSV export
Used for
Making sure requests are handled and spotting where staff need help.

Security alerts

For service owner and privacy officer

Unusual activity alerts, what was found, the action taken and whether anything was escalated.

Break down by
Alert type, Outcome, Department, Period
Delivered as
Live view; scheduled email
Used for
Checking that alerts are reviewed and acted on within the runbook.

Migration progress

For service owner and department leads

Source locations, content moved, items skipped and the reason, and permission mapping issues.

Break down by
Source, Department, Status, Issue type
Delivered as
Live view during migration; CSV export
Used for
Tracking the move from file shares and resolving issues before cutover.

Access and sharing

Outside collaborators

For folder owners and privacy officer

Every outside collaborator by folder, their access level, when they were added and when they last used it.

Break down by
Folder, Collaborator domain, Access level, Last activity
Delivered as
Periodic review list; CSV export
Used for
Confirming or removing outside access, especially when projects end.

Shared links

For privacy officer and folder owners

Shared links by folder and classification, who can open them and whether they expire.

Break down by
Folder, Classification, Link access, Expiry
Delivered as
Live view; CSV export
Used for
Finding links that are open more widely than the rules intend.

Sharing exceptions

For privacy officer

Exceptions requested and approved, the reason, the approver and the end date.

Break down by
Folder, Requester, Decision, End date
Delivered as
Live view; PDF export
Used for
Reviewing exceptions and making sure they end when they should.

Management

Monthly service report

For service owner and IT leadership

Users, storage, requests, alerts, changes applied and decisions due in the month.

Break down by
Period, Department, Request type
Delivered as
PDF; reviewed in the monthly service meeting
Used for
Overseeing the service and making the decisions Moraph brings.

Licences and storage

For service owner and finance

Licences assigned and unused, storage by department, and accounts inactive for the period you set.

Break down by
Department, Licence type, Activity, Period
Delivered as
Monthly service report; CSV export
Used for
Right-sizing licences before renewal.

Compliance and audit

Retention and holds

For records manager, legal and privacy officer

Retention policies and where they apply, legal holds in place, and content reaching the end of retention.

Break down by
Policy, Folder, Hold, Disposition date
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that retention and holds are applied as decided.

Configuration change history

For service owner and auditors

Every configuration change, who proposed and approved it, and when it was applied.

Break down by
Setting area, Change date, Approver, Change type
Delivered as
Live view; PDF and CSV export
Used for
Showing auditors that the platform is governed and changes approved.

Administrator content access

For privacy officer and auditors

Each time Moraph staff were authorized to access content, who authorized it, the scope and the period.

Break down by
Authorization, Moraph staff member, Folder, Date range
Delivered as
Live view; PDF export
Used for
Confirming that administrative access to content was authorized and limited.

Exports, access and evidence

  • Reports Moraph produces are available in its service portal and can be exported to CSV, with summary and evidence reports in PDF. The monthly service report is delivered before each service meeting.
  • Box's own admin console reports remain available to the people you grant access, and Moraph's reports combine them with request, change and alert records.
  • Box events can be forwarded to your SIEM so content activity appears alongside your other security data.
  • Reports respect each viewer's role: folder owners see their own folders, the privacy officer sees sharing and exceptions across the organization, and auditors get read-only access with a scope and an end date.
  • Running and exporting a report is recorded in the audit trail, and compliance reports can be run for a past period.

Deployment

Where and how it runs

Box cloud service

Box operates the content platform in its cloud under your Box agreement; Moraph configures and administers it for you.

Existing Box enterprise

Where you already use Box, Moraph reviews and takes over administration of your existing enterprise without moving content again.

With other Moraph services

Run alongside Moraph's Email Security, Identity Governance or Clinical Collaboration services.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Scoping

We agree the users, departments, content sources and Box add-ons in scope, and review any existing Box enterprise. We need contacts from IT, privacy, records and the departments moving first.

Agreements and identity

Business associate agreements are put in place with Box and Moraph, and Box is connected to your identity provider for sign-in and provisioning.

Configuration baseline

Enterprise settings, sharing rules, classification labels and folder structure are configured from a documented baseline and reviewed with your service owner and privacy officer.

Retention and holds

Your records manager's retention schedule is translated into Box policies, where licensed, and the process for legal holds agreed with your legal team.

Migration in waves

Content moves department by department, with your teams deciding what moves, what is archived and what is deleted, and permissions checked after each wave.

Training and handover

Folder owners are trained on sharing and access reviews, the support runbook and escalation routes are agreed, and Moraph takes over administration.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Box. Box's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
  • Licences bought through Moraph remain subject to Box's terms, and some features described here, such as classification, threat alerts and retention, depend on the add-ons you license.
  • Box is a content platform, not an electronic health record or a research data capture system. Clinical documentation stays in your EHR.
  • A business associate agreement with Box is your organization's agreement with Box; Moraph's agreement covers only Moraph's administration and support.
  • Sharing rules reduce the chance of content being shared wrongly; they cannot stop an authorized person from sharing data they are permitted to share.
  • What is migrated, archived or deleted, and how long content is kept, are your organization's decisions.
  • Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
  • Moraph supports your audits and research compliance reviews with evidence; it does not certify your compliance with HIPAA or 21 CFR Part 11.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List the content sources you would move and decide what you would archive or delete instead
  2. Draft your sharing rules for PHI, research data and general content and review them with Moraph
  3. Check which Box add-ons your use of classification, alerts and retention would need
  4. Walk through a sharing exception from request to end date
  5. Review how Moraph's access to content is authorized and reported
  6. Confirm who on your side owns each top-level area and approves configuration changes

Questions

Frequently asked questions

Can we store PHI in Box?

Box for Healthcare is offered with a business associate agreement from Box, and Moraph signs its own for administration and support. What PHI you store, and where, is your decision, and Moraph configures classification and sharing rules to match it.

Can Moraph's administrators read our files?

Not without your authorization. Moraph administers users, folders and settings, and opens content only with your explicit, time-bound authorization, which is logged and reported.

We already use Box. Can you take it over?

Yes. Moraph reviews your existing enterprise, agrees a configuration baseline with you and takes over administration without moving content again.

Can researchers share with collaborators at other institutions?

Yes, within the sharing rules your privacy officer sets. Folders labeled as holding PHI can require an approved exception, with an end date, before outside collaborators are added.

Does this replace our EHR's document storage?

No. Clinical documentation stays in your EHR. Box is for content outside it, such as research files, policies, committee papers and shared project documents.

How is it priced?

Box licences and add-ons are priced under Box's terms, usually per user, and the managed service by the scope administered and migrated. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Cloud Content

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Cloud Content guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Cloud Content support guide.

Related products