Cloud Content

Principal workflows

• Organize: Content is arranged in a folder structure agreed with you, with each top-level area owned by a department or project and access granted through groups from your identity provider.
• Share: Staff share files and folders with colleagues and approved outside collaborators within the rules your privacy officer sets, and folder owners can see and revoke what has been shared.
• Govern: Retention policies and legal holds are configured in Box as your records and legal teams direct, so content is kept for as long as required and no longer.
• Support and monitor: Moraph handles requests from your service desk and folder owners, reviews security alerts and unusual activity, and meets you monthly to review the service.

Who uses it

• IT and infrastructure leaders at hospitals, health systems and academic medical centers
• Research administrators and investigators who share files with outside collaborators
• Privacy and compliance officers responsible for where PHI is stored and shared
• Records managers and legal teams who set retention and legal holds
• Policy and quality teams who publish and maintain controlled documents

Reporting

• Outside collaborators and shared links by folder
• Sharing exceptions and their end dates
• Security alerts and actions taken
• Retention policies, legal holds and upcoming disposition
• Requests, restores and migration progress
• Configuration changes and administrator content access for auditors

Features

• HIPAA-capable storage: Box for Healthcare is offered with a business associate agreement from Box, and Moraph configures it with the settings your organization needs to store PHI.
• Folder structure and ownership: Top-level areas for departments and projects, each with a named owner, and access granted through groups rather than individual invitations.
• Sharing rules: Box enforces your defaults for shared links and outside collaborators, such as who may open a link and whether it expires.
• Classification labels: Box Shield labels mark content such as PHI or research data and apply stricter sharing and download rules to it, where licensed.
• Unusual activity alerts: Box Shield raises alerts for activity such as large downloads or suspicious sign-ins, reviewed by Moraph under your runbook, where licensed.
• Retention and legal holds: Box Governance applies retention policies and legal holds that your records and legal teams decide, where licensed.
• Version history and recovery: Box keeps file versions and deleted content for the periods your settings allow, and Moraph restores content on request.
• Outside collaborator review: Periodic lists of outside collaborators by folder for owners to confirm or remove, so access ends when projects do.
• Migration from file shares: Moraph plans and runs moves from file shares and other repositories, with your teams deciding what moves, what is archived and what is deleted.
• Desktop and mobile access: Box Drive and the Box mobile apps configured with your device rules, so staff work with files without keeping uncontrolled copies.
• Office editing: Documents opened and edited with Microsoft 365 or Google Workspace from Box, where your organization uses them.
• Administration as a service: User, group and folder administration, access requests and restores handled by Moraph through your service desk.

Integrations

• Single sign-on and provisioning: Staff sign in to Box through your identity provider (SAML), and accounts and groups are provisioned from it.
• File shares and other repositories: Content moved from network file shares and other repositories during migration, with folder permissions mapped where possible.
• Microsoft 365 or Google Workspace: Documents stored in Box opened and edited in the office tools your organization uses.
• SIEM: Box events such as sign-ins, downloads, sharing changes and admin actions forwarded to your security information and event management system.
• Device management: Box Drive and mobile apps deployed and controlled through your mobile device management tools.
• Service desk: Access requests, restores and incidents flow between Moraph and your IT service management tool.

Deployment

• Box cloud service: Box operates the content platform in its cloud under your Box agreement; Moraph configures and administers it for you.
• Existing Box enterprise: Where you already use Box, Moraph reviews and takes over administration of your existing enterprise without moving content again.
• With other Moraph services: Run alongside Moraph's Email Security, Identity Governance or Clinical Collaboration services.

Security and privacy

• Single sign-on: Staff sign in through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Administration, support and folder ownership are separate roles, and Moraph's administrators do not open your content without authorization.
• Business associate agreements: Moraph signs a business associate agreement with you for its administration and support, alongside your agreement with Box for the Box service.
• Encryption and keys: Box encrypts content as part of its service, and Moraph staff cannot use their administrative access to reach content without your explicit, time-bound authorization.
• Complete audit trail: Every configuration change, access grant, restore and authorized content access by Moraph is logged with the person and time.
• Data residency: Records Moraph keeps about the service stay in the hosting region you choose: the United States, the United Kingdom or Australia. Where Box stores content follows your Box agreement.

Limitations

• Moraph is not Box. Box's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Box's terms, and some features described here, such as classification, threat alerts and retention, depend on the add-ons you license.
• Box is a content platform, not an electronic health record or a research data capture system. Clinical documentation stays in your EHR.
• A business associate agreement with Box is your organization's agreement with Box; Moraph's agreement covers only Moraph's administration and support.
• Sharing rules reduce the chance of content being shared wrongly; they cannot stop an authorized person from sharing data they are permitted to share.
• What is migrated, archived or deleted, and how long content is kept, are your organization's decisions.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Moraph supports your audits and research compliance reviews with evidence; it does not certify your compliance with HIPAA or 21 CFR Part 11.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/cloud-content. Purchasing routes and company information: www.moraph.com/how-to-buy.