Healthcare · Managed platform (Jamf / Workspace ONE)

Enterprise Mobility

Shared clinical iPads and handhelds, reset between shifts and run for you

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Jamf or Workspace ONE to manage the shared iPads, iPhones and Android handhelds your clinicians carry on the unit, including devices used with Epic Rover and similar mobile apps. The platform enrolls each device, applies your configuration, and erases or resets shared devices between shifts so the next clinician starts clean. Moraph's service team watches the fleet every day, works the exceptions, and gives your IT and security teams the evidence they need for HIPAA.

The problem it solves

Shared mobile devices on clinical units pass from one clinician to the next at every shift change. When a device is not reset, the next user can open the last person's session, cached messages or photos, and patient information sits on a device that may leave the building in a pocket. Most hospital IT teams manage these devices alongside laptops and desktops, with little time to check that every handheld was wiped, charged, updated and returned. Lost devices are reported late, and when an auditor asks how shared devices are protected, the answer is a policy rather than a record.

  • Shared devices are not always reset between users, leaving sessions and cached data behind
  • Devices go missing or sit uncharged and out of date in drawers
  • Device configuration drifts from what security and clinical informatics agreed
  • There is no routine record showing each device was wiped and compliant

Who uses it

  • Hospital and health system IT teams responsible for clinical mobile devices
  • Nursing and unit leaders whose staff share iPads and handhelds across shifts
  • Clinical informatics teams who own Epic Rover and other mobile clinical apps
  • HIPAA security officers who need evidence that devices holding PHI are protected
  • Ambulatory and post-acute providers running shared tablets for intake and care

Requirements it supports

HIPAA Security Rule (45 CFR Part 164, Subpart C)HIPAA Privacy Rule (45 CFR Part 164, Subpart E)HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the EnterpriseNIST SP 800-88 Rev. 1, Guidelines for Media Sanitization

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

The platform vendor provides and operates Jamf or Workspace ONE, Moraph configures and runs your use of it, and your organization makes the policy decisions and owns the devices.

AreaMoraphJamf / Workspace ONEYour organization
LicensingResells platform licenses and keeps license counts aligned with your fleetSets license terms and product availabilityAgrees the devices to license and pays under the order
Platform availabilityMonitors availability, raises incidents with the vendor and keeps you informedOperates the cloud platform under its own service commitmentsTells Moraph about clinical impact
Device configurationBuilds and maintains profiles, apps and reset behavior to the approved baselineProvides the management features and supported settingsApproves the baseline and device roles
EnrollmentConfigures enrollment and assigns devices to the right profilesProvides enrollment services and connections to Apple and GoogleBuys devices through channels linked to your Apple Business Manager or zero-touch account
Daily monitoringReviews compliance and reset exceptions and works themReports device status to the platformReturns devices to charging locations and responds on the unit
Lost devicesLocks or wipes on instruction and records the actionsDelivers the commands to the deviceReports losses promptly and decides on breach notification
UpdatesTests and stages operating system and app updatesReleases platform updates and maintains support for new operating systemsApproves updates and joins pilot testing
Identity and networkConfigures the platform to use your identity provider and certificatesProvides the integration pointsRuns Wi-Fi, identity and certificate services
IncidentsLeads incident handling for the service and reports cause and fixResolves platform incidents and provides root cause where availableDecides on any regulatory or patient notification
HardwareIdentifies faulty devices and tells youNot applicableOwns devices, warranties, repairs and replacements

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Jamf / Workspace ONE itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    During onboarding, each unit moves from baseline approval to a live, monitored fleet, with the owner of each step visible.

    UnitDevicesBaseline approvedPilotEnrolledStatus
    Example Medical Center, 4 West24 iPhonesYesComplete24 of 24Live
    Example Medical Center, ICU18 iPhonesYesComplete18 of 18Live
    Example Medical Center, Registration12 iPadsYesIn progress9 of 12Pilot
    Example Clinic, Intake8 Android tabletsYesNot started0 of 8Waiting on Wi-Fi certificate
    Example Medical Center, ED30 iPhonesPending security reviewNot started0 of 30On hold
    During onboarding, each unit moves from baseline approval to a live, monitored fleet, with the owner of each step visible.

  2. Step 2

    Morning reset check

    Before the day shift, the service team sees which shared devices did not reset overnight and why.

    DeviceUnitReset methodLast check-inReasonAction
    Device 4W-0174 WestErase and re-enroll9 hours agoNot on Wi-FiUnit asked to dock
    Device ICU-006ICUErase and re-enroll7 hours agoErase not confirmedCommand re-sent
    Device REG-003RegistrationSession sign-out1 hour agoUser still signed inSigned out remotely
    Device 4W-0224 WestErase and re-enroll2 days agoNot seenFlagged as possibly missing
    Before the day shift, the service team sees which shared devices did not reset overnight and why.

  3. Step 3

    A lost device

    When a device is reported missing, each step is recorded for the security officer's breach assessment.

    Lost device LD-0214 · Device 4W-022

    1. Device reported missing by 4 West charge nurseUnit leader
    2. Ticket logged and routed to MoraphService desk
    3. Lost mode enabled with return messageMoraph service team
    4. Wipe instructed after device not foundHIPAA security officer
    5. Wipe command sent; confirmation pending device check-inMoraph service team
    6. Record passed for breach assessmentMoraph service team
    When a device is reported missing, each step is recorded for the security officer's breach assessment.

  4. Step 4

    A change request

    A clinical app change is made only once its owner and, where security is affected, the security officer have approved it.

    Change CR-1187 · Add clinical app to ICU device role

    Requested by
    Clinical informatics lead
    Device role
    ICU shared iPhone
    Change
    Add approved clinical app and its managed settings
    Security impact
    Reviewed, none
    Pilot
    ICU pilot group, 3 devices
    Status
    Approved, scheduled

    Approvals

    • Clinical informatics lead: approved
    • Client IT endpoint team: approved
    • HIPAA security officer: not required, no security setting changed
    A clinical app change is made only once its owner and, where security is affected, the security officer have approved it.

  5. Step 5

    Quarterly baseline review

    Each quarter Moraph compares the live platform with the approved baseline and reviews differences with you.

    Configuration baseline review · Example Health System

    Device roles reviewed
    7
    Settings matching baseline
    All but 2
    Changes since last review
    11, all with approved requests
    Operating system minimum
    Current baseline version
    Administrator accounts
    14, reviewed

    Differences found

    • !Registration iPads: auto-lock longer than baseline, from a pilot setting not reverted
    • !Two administrator accounts unused for the period your policy sets
    • Recommend adding the new operating system version to the baseline after pilot
    Each quarter Moraph compares the live platform with the approved baseline and reviews differences with you.

  6. Step 6

    Monthly service review

    Each month, Moraph and your IT team review the fleet, exceptions, losses and changes, using fictional figures here.

    MeasureThis monthLast monthNote
    Managed devices412398ED pilot added
    Reset exceptions3752Fewer Wi-Fi dead spots after access point move
    Devices not seen for policy period642 under investigation
    Lost or stolen devices21Both wiped on instruction
    Change requests applied97All approved
    Open vendor incidents01Closed
    Each month, Moraph and your IT team review the fleet, exceptions, losses and changes, using fictional figures here.

Workflows

The principal workflows

  1. Enroll

    New and returning devices are enrolled automatically through Apple Business Manager or Android Enterprise zero-touch, so they arrive on the unit already configured and assigned.

    • Devices purchased through your reseller are assigned to your Apple Business Manager or zero-touch account
    • Moraph assigns each device to the right enrollment profile and site
    • The platform applies Wi-Fi, certificates, restrictions and approved apps on first start
    • The device appears in its unit's group with its owner and charging location recorded
    • Any device that fails enrollment is raised as an exception for the service team

  2. Hand over between shifts

    Shared devices are reset between users. Depending on the device and the platform, that is an erase and automatic re-enrollment, a shared-device sign-out, or a check-in that clears the last user's session and data.

    • The clinician signs out or returns the device to its charging cart at shift end
    • The platform clears the user session or erases and re-enrolls the device, as configured for that device type
    • The device comes back with its configuration and clinical apps in place
    • Devices that did not reset are listed for the service team before the next shift
    • The service team works each exception with the unit or client IT

  3. Keep compliant

    Moraph checks the fleet every day against the configuration baseline your security team approved: passcode, encryption, operating system version, approved apps and last check-in.

    • The platform reports each device's compliance status
    • Moraph reviews the daily compliance list and devices that have not checked in
    • Operating system and app updates are scheduled in agreed maintenance windows, unit by unit
    • Non-compliant devices are restricted as your policy sets and the unit is told
    • Configuration drift from the baseline is corrected through a change request

  4. Respond to loss

    When a device is lost or stolen, Moraph puts it into lost mode or wipes it remotely on the instruction of your designated contacts, and records what happened for your privacy and security officers.

    • The unit or service desk reports the device as missing
    • Moraph locks the device and shows a return message, or wipes it if your contact instructs
    • Last known check-in and, where enabled and permitted, location are recorded
    • The record is passed to your security officer for any breach assessment
    • The device is retired or re-enrolled when it is found

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Unit leader

Nurse manager, charge nurse, department manager

Makes sure the unit has working, reset devices at each shift and reports problems quickly.

Sees

  • The devices assigned to their unit and whether each reset and checked in
  • Devices from their unit flagged as missing or not compliant
  • Open requests they have raised

Does

  • Reports a lost, damaged or faulty device
  • Asks for devices to be added, moved or retired for the unit
  • Confirms device counts during periodic reconciliation
  • Passes reset problems to the service desk

Cannot

  • Wipe or lock a device remotely
  • Change device configuration or apps
  • See other units' devices
Approvals
Requests to add or move devices are approved by client IT; nothing they do needs approval of their own.
Notified about
Devices from their unit that did not reset before the shift, devices not seen for a period your policy sets, and progress on their requests.

Clinical informatics lead

Clinical informatics manager, nursing informatics specialist, Epic application analyst

Owns what clinicians see on the device: clinical apps, their settings and the home-screen layout for each device role.

Sees

  • Device roles and the apps and layouts assigned to each
  • App versions deployed and pilot results
  • Change requests affecting clinical apps

Does

  • Requests changes to apps and layouts for a device role
  • Approves clinical app updates after pilot testing
  • Joins pilot testing of operating system updates
  • Reviews reset behavior with clinical users

Cannot

  • Change security settings such as passcode or wipe rules
  • Make changes directly in the platform
  • Approve their own change request where your policy requires a second approver
Approvals
Approves clinical app and layout changes; security-related changes also need the HIPAA security officer.
Notified about
Pilot results ready for review, app update releases, and requests affecting clinical apps.

Client IT endpoint team

Endpoint manager, desktop and mobility engineer, IT infrastructure manager

Owns the systems devices depend on, such as Wi-Fi, certificates, identity and purchasing, and is Moraph's technical counterpart.

Sees

  • The whole fleet and its compliance status
  • The configuration baseline and change history
  • Service reports and open incidents

Does

  • Approves technical change requests
  • Maintains Wi-Fi, certificate and identity services devices use
  • Orders devices and keeps purchasing linked to enrollment
  • Works network or identity issues Moraph escalates
  • Joins the monthly service review

Cannot

  • Override the security baseline without the HIPAA security officer
  • Edit the change record after the fact
  • Approve their own request where two approvers are required
Approvals
Approves technical changes; changes to the security baseline also need the HIPAA security officer.
Notified about
Enrollment failures, incidents, platform notices from the vendor that affect you, and change requests waiting for approval.

HIPAA security officer

HIPAA security officer, CISO, information security manager

Sets the security requirements for devices that hold or display PHI and uses the service's records as evidence.

Sees

  • The security baseline and every change to it
  • Compliance status across the fleet
  • Lost and stolen device records and wipe confirmations
  • Access to the platform by Moraph and client staff

Does

  • Approves the security baseline, including passcode, encryption and wipe rules
  • Instructs remote wipes where policy requires their decision
  • Assesses lost-device records for breach notification
  • Reviews administrative access to the platform
  • Uses service reports as evidence for risk analysis and audits

Cannot

  • Edit or delete the record of actions taken on a device
  • Make configuration changes directly in the platform
Approvals
Approves security baseline changes and exceptions to it.
Notified about
Lost or stolen devices, wipes performed, baseline exceptions requested, and access reviews due.

Moraph service team

Moraph mobility engineers and service managers

Runs the platform on your behalf: configuration, daily monitoring, updates, exceptions and incidents.

Sees

  • Platform configuration, device inventory and compliance status
  • Reset and check-in exceptions
  • Change requests and their approvals

Does

  • Configures enrollment, profiles, apps and reset behavior to the approved baseline
  • Reviews compliance and reset exceptions each day and works them
  • Schedules and stages operating system and app updates
  • Locks or wipes devices on instruction from your named contacts
  • Raises and follows incidents with the platform vendor
  • Prepares the monthly service review

Cannot

  • Change the baseline without an approved change request
  • Wipe a device that is not reported lost or due for reset without instruction
  • Use privileged access outside approved, time-bound work
Approvals
Every configuration change is made against a change request approved by the owner you name.
Notified about
Platform alerts, devices that miss a reset, enrollment failures, and vendor service notices.

Service desk

IT service desk analyst, tier 1 support

Takes calls from clinicians and units about devices and routes them to Moraph or client IT.

Sees

  • Device status and last check-in for a device being reported
  • Known issues and planned updates

Does

  • Logs device problems and lost-device reports
  • Runs agreed first-line steps such as restarting or re-checking a device
  • Routes tickets to the Moraph service team or client IT

Cannot

  • Wipe, lock or reconfigure devices
  • Change apps or profiles
Approvals
None; tickets they raise are worked by Moraph or client IT.
Notified about
Planned updates and known issues affecting units.

Auditor (read-only)

Internal auditor, compliance analyst, external assessor under temporary access

Reviews evidence that shared devices are configured, reset and handled as policy requires.

Sees

  • The configuration baseline and change history
  • Compliance and reset reports for the period in scope
  • Lost-device records and wipe confirmations

Does

  • Reads and exports reports within their scope, with each export logged
  • Requests further evidence through the HIPAA security officer

Cannot

  • Change, approve or delete anything
  • Keep access after the agreed end date
Approvals
Access is approved by the HIPAA security officer with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionUnit leaderInformaticsClient ITSecurityMoraph teamService deskAuditor
Report a lost or faulty deviceOwn work onlyNo accessFullFullFullFullNo access
Lock or wipe a device remotelyNo accessNo accessApprovesApprovesFullNo accessNo access
Change device configuration profilesNo accessNo accessApprovesApprovesFullNo accessView only
Change clinical apps and layoutsNo accessApprovesView onlyView onlyFullNo accessView only
Change passcode, encryption or wipe rulesNo accessNo accessView onlyApprovesFullNo accessView only
Approve operating system updatesNo accessApprovesApprovesView onlyFullNo accessNo access
Add, move or retire devicesOwn work onlyNo accessApprovesNo accessFullNo accessNo access
Work reset and compliance exceptionsView onlyNo accessFullView onlyFullView onlyNo access
View the configuration baselineNo accessView onlyView onlyView onlyFullNo accessView only
View lost-device and wipe recordsOwn work onlyNo accessView onlyView onlyFullNo accessView only
Manage platform administrator accessNo accessNo accessApprovesApprovesFullNo accessNo access
View service reportsOwn work onlyView onlyView onlyView onlyFullNo accessView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph changes profiles, apps, restrictions and wipe rules only against a change request approved by the owner you name, and each change is recorded with the request it came from.
  • Remote wipes outside the normal shift reset are performed only on instruction from your named contacts, and each one is recorded with who asked, who acted and when.
  • Platform administrator roles are agreed with you during onboarding and can follow your identity provider's groups. Administrative access is reviewed with your security officer at the periodic access review.
  • Units see only their own devices. Auditors receive temporary read-only access to reports with a defined scope and an end date, rather than shared accounts.

Features

What it does

Shared-device reset

Jamf or Workspace ONE erases and re-enrolls shared devices, or clears the user session, between shifts, as configured for each device type.

Zero-touch enrollment

Devices enroll through Apple Business Manager or Android Enterprise zero-touch and receive their configuration on first start, without hand setup.

Unit and role profiles

Each unit or device role gets its own Wi-Fi, certificates, restrictions, home screen and apps, so an ICU handheld and a registration tablet are set up differently.

Single-app and kiosk modes

Devices used for one purpose, such as patient intake or a clinical app, can be locked to that app or a limited home screen.

App distribution

Clinical and business apps are pushed and updated through the platform, using Apple's volume purchasing or managed Google Play.

Daily compliance check

Moraph reviews passcode, encryption, operating system version and last check-in for every device each day and works the exceptions.

Reset exception list

Devices that did not reset or check in after a shift change are listed for the service team before the next shift starts.

Lost-device response

Lost mode, remote lock and remote wipe on instruction from your named contacts, with each action recorded.

Staged updates

Operating system and app updates are tested on a pilot group, then released unit by unit in agreed windows to avoid disrupting care.

Configuration baseline

The agreed device configuration is documented, and Moraph checks the live platform against it and reviews it with you each quarter.

Change requests

Changes to profiles, apps, restrictions and wipe rules are made only against a request approved by the owner you name, and recorded.

Service reporting

A monthly service review covers fleet size, compliance, reset exceptions, lost devices, changes and open issues.

Integrations

How it connects to your systems

Connects toHowWhat flows
Apple Business ManagerDevices bought through participating resellers are assigned for automatic enrollment, and apps are licensed through Apple's volume purchasing.In: device serial numbers and app licenses.
Android EnterpriseAndroid handhelds enroll through zero-touch or managed enrollment, and apps come from managed Google Play.In: device registrations and approved apps.
Identity providerAdministrators sign in through your identity provider, and where configured clinicians sign in to shared devices with their network credentials.In: user identity and group membership.
Certificate servicesDevice certificates for Wi-Fi and app authentication are issued from your certificate authority through the platform.In: certificates issued to managed devices.
Clinical mobile appsEpic Rover, Haiku, Limerick and other clinical apps are deployed with the managed configuration their vendors document.Out: app configuration values to devices.
IT service managementDevice tickets flow between your service desk and Moraph's service team, including Moraph's IT Service Management service where you use it.In and out: tickets, status and resolution.
Single sign-on on devicesShared devices can be set up to work with your badge or single sign-on service, including Moraph's Single Sign-On service built on Imprivata.In: sign-on configuration for shared devices.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your administrators and Moraph's staff sign in to the platform through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Units see their own devices, client IT sees the fleet, and Moraph's service team works on configuration rather than on the content of devices.

Recorded device actions

Every lock, wipe, configuration change and enrollment is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. The platform vendor's own assurance reports are available from the vendor under its terms.

Business associate agreement

Where the service involves PHI on devices or in the platform, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Shift reset exceptions

For moraph service team, client IT, unit leaders

Shared devices that did not reset or check in after a shift change, with their unit and last check-in.

Break down by
Unit, Device type, Reset method, Exception reason
Delivered as
Daily list; live view
Used for
Making sure each shared device is reset before the next clinician picks it up.

Daily compliance

For moraph service team and client IT

Devices out of line with the baseline: passcode, encryption, operating system version, required apps or last check-in.

Break down by
Unit, Compliance rule, Device type, Days out of compliance
Delivered as
Daily list; CSV export
Used for
Finding and fixing devices that fall outside policy.

Devices not seen

For unit leaders and client IT

Devices that have not checked in for a period your policy sets, with their last known unit and user.

Break down by
Unit, Days since check-in, Device type
Delivered as
Weekly email; live view
Used for
Finding devices left in drawers or taken off site before they are reported lost.

Update rollout

For client IT and clinical informatics

Operating system and app update progress by unit and pilot group, with devices that failed to update.

Break down by
Update, Unit, Pilot or production, Status
Delivered as
Live view during rollouts
Used for
Following a staged update and stopping it if a problem shows up.

Security and compliance

Lost and stolen devices

For hIPAA security officer and privacy officer

Each reported loss with the date, unit, actions taken, wipe confirmation and outcome.

Break down by
Period, Unit, Action taken, Outcome
Delivered as
Live view; PDF export
Used for
Supporting breach assessments and showing that losses were handled.

Configuration baseline and changes

For hIPAA security officer, client IT, auditors

The approved baseline and every change made to it, with the request, approver and date.

Break down by
Change type, Approver, Period, Device role
Delivered as
Quarterly review pack; PDF export
Used for
Evidencing that device configuration is controlled.

Administrator access review

For hIPAA security officer

Everyone with administrative access to the platform, including Moraph staff, with their role and last use.

Break down by
Organization, Role, Last sign-in
Delivered as
At each access review; PDF export
Used for
Certifying that only the right people can manage devices.

Wipe and reset record

For hIPAA security officer and auditors

Erase and reset actions over a period, by device and unit, with confirmation from the platform.

Break down by
Period, Unit, Reset method, Confirmation status
Delivered as
On request; CSV export
Used for
Showing that shared devices were cleared between users.

Service

Monthly service review

For client IT and service owners

Fleet size, compliance, reset exceptions, lost devices, changes made, incidents and open issues for the month.

Break down by
Month, Site, Category
Delivered as
PDF; review meeting
Used for
Reviewing the service with Moraph and agreeing priorities.

Change request log

For client IT, clinical informatics, security officer

Every change request with its requester, approver, status and the date it was applied.

Break down by
Status, Requester, Change type, Period
Delivered as
Live view; CSV export
Used for
Tracking what is changing on devices and who agreed it.

Fleet inventory

For client IT, finance and unit leaders

Every managed device with its model, operating system, unit, enrollment date and status.

Break down by
Site, Unit, Model, Status
Delivered as
Monthly; CSV export
Used for
Reconciling devices and licenses and planning replacements.

Exports, access and evidence

  • Reports come from the platform's own data and Moraph's service records. Moraph assembles the daily lists and the monthly review; you can also see live data in the platform where your role allows.
  • Every report can be exported to CSV, and review and evidence reports to PDF.
  • Unit leaders see only their own unit's devices; client IT and the security officer see the whole fleet.
  • Device data can be delivered to your data warehouse or IT service management tool where the platform supports export.
  • Producing and exporting evidence reports is recorded, and reports for audits can be run for a past period.

Deployment

Where and how it runs

Vendor cloud, managed by Moraph

Jamf or Workspace ONE runs in the vendor's cloud; Moraph configures and runs it for you under a managed service agreement.

Moraph-managed with your existing licenses

If you already license Jamf or Workspace ONE, Moraph can take over configuration and operations, subject to the vendor's terms.

Alongside other Moraph services

Run with Moraph's Single Sign-On, Secure Messaging or Asset Tracking services so devices, sign-on and messaging are managed together.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Current-state review

We review your devices, units, clinical apps and any existing management tool, and agree which devices are shared and how each should be reset.

Baseline design

Security, clinical informatics and client IT agree the configuration baseline for each device role, including passcode, encryption, apps, layouts and reset method.

Platform setup

The platform is connected to Apple Business Manager or Android Enterprise, your identity provider and certificate services, and profiles are built to the baseline.

Pilot unit

One or more units run on the managed configuration first, and reset behavior and clinical apps are checked with the people who use them.

Unit-by-unit rollout

Remaining units move over in an agreed order, with devices re-enrolled or migrated from your previous tool where the platform supports it.

Handover to service

Daily monitoring, change requests, lost-device procedures and the monthly service review begin, and your contacts are confirmed.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Jamf or Omnissa, the vendor of Workspace ONE. The platform belongs to its vendor, and the vendor's own service commitments, roadmap, maintenance and outages apply to it.
  • Licenses are subject to the vendor's terms, and the settings available depend on what the platform and the device's operating system support.
  • How a shared device is reset depends on its type and operating system. Some devices are erased and re-enrolled, others have their user session cleared; the method is agreed for each device role.
  • A device that is switched off, out of Wi-Fi range or not returned cannot receive a reset or wipe until it reconnects. The exception list shows these devices; it cannot reach them.
  • Location of lost devices is available only where the platform, the operating system and your policy allow it.
  • Moraph does not supply, repair or replace hardware, and does not manage personally owned devices unless that is agreed in scope.
  • Your organization remains responsible for its HIPAA risk analysis, device policies and breach notification decisions.
  • Clinical app behavior and configuration are governed by each app's vendor; Moraph deploys apps with the settings those vendors document.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Pick one unit and walk through what happens to a shared device from the end of one shift to the start of the next
  2. Ask to see a sample reset exception list and how each exception would be worked
  3. Review the draft configuration baseline with your security officer and clinical informatics lead
  4. Walk through a lost-device report from the unit to the record your security officer receives
  5. Check how operating system updates would be piloted and released on your units
  6. Confirm who at your organization approves changes and instructs wipes

Questions

Frequently asked questions

Do you support both Jamf and Workspace ONE?

Yes. Jamf suits fleets that are mostly Apple; Workspace ONE suits mixed Apple and Android fleets. We recommend one during the current-state review based on your devices and existing licenses.

How are shared devices wiped between shifts?

It depends on the device. Some are erased and re-enrolled automatically; others have the user session cleared on sign-out. The method for each device role is agreed with your security and clinical informatics teams, and devices that miss a reset are listed for follow-up.

Can Moraph wipe a device without our say?

Shift resets run as configured. Any other lock or wipe is done on instruction from the contacts you name, and each one is recorded.

We already license Jamf or Workspace ONE. Can Moraph take it over?

Usually, subject to the vendor's terms. We start with a review of your current configuration against your policies and agree what needs to change.

What happens when the platform has an outage?

Moraph raises and follows the incident with the vendor, keeps you informed and records the effect on devices. The vendor's own service commitments govern the platform itself.

How is it priced?

Platform licenses are priced under the vendor's terms, usually per device, and Moraph's managed service is priced separately. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Enterprise Mobility

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Enterprise Mobility guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Enterprise Mobility support guide.

Related products