Enterprise Mobility

Principal workflows

• Enroll: New and returning devices are enrolled automatically through Apple Business Manager or Android Enterprise zero-touch, so they arrive on the unit already configured and assigned.
• Hand over between shifts: Shared devices are reset between users. Depending on the device and the platform, that is an erase and automatic re-enrollment, a shared-device sign-out, or a check-in that clears the last user's session and data.
• Keep compliant: Moraph checks the fleet every day against the configuration baseline your security team approved: passcode, encryption, operating system version, approved apps and last check-in.
• Respond to loss: When a device is lost or stolen, Moraph puts it into lost mode or wipes it remotely on the instruction of your designated contacts, and records what happened for your privacy and security officers.

Who uses it

• Hospital and health system IT teams responsible for clinical mobile devices
• Nursing and unit leaders whose staff share iPads and handhelds across shifts
• Clinical informatics teams who own Epic Rover and other mobile clinical apps
• HIPAA security officers who need evidence that devices holding PHI are protected
• Ambulatory and post-acute providers running shared tablets for intake and care

Reporting

• Shared devices that missed their shift reset
• Daily compliance exceptions across the fleet
• Lost and stolen devices with actions and outcomes
• Configuration baseline and change history
• Update rollout progress by unit
• Monthly service review

Features

• Shared-device reset: Jamf or Workspace ONE erases and re-enrolls shared devices, or clears the user session, between shifts, as configured for each device type.
• Zero-touch enrollment: Devices enroll through Apple Business Manager or Android Enterprise zero-touch and receive their configuration on first start, without hand setup.
• Unit and role profiles: Each unit or device role gets its own Wi-Fi, certificates, restrictions, home screen and apps, so an ICU handheld and a registration tablet are set up differently.
• Single-app and kiosk modes: Devices used for one purpose, such as patient intake or a clinical app, can be locked to that app or a limited home screen.
• App distribution: Clinical and business apps are pushed and updated through the platform, using Apple's volume purchasing or managed Google Play.
• Daily compliance check: Moraph reviews passcode, encryption, operating system version and last check-in for every device each day and works the exceptions.
• Reset exception list: Devices that did not reset or check in after a shift change are listed for the service team before the next shift starts.
• Lost-device response: Lost mode, remote lock and remote wipe on instruction from your named contacts, with each action recorded.
• Staged updates: Operating system and app updates are tested on a pilot group, then released unit by unit in agreed windows to avoid disrupting care.
• Configuration baseline: The agreed device configuration is documented, and Moraph checks the live platform against it and reviews it with you each quarter.
• Change requests: Changes to profiles, apps, restrictions and wipe rules are made only against a request approved by the owner you name, and recorded.
• Service reporting: A monthly service review covers fleet size, compliance, reset exceptions, lost devices, changes and open issues.

Integrations

• Apple Business Manager: Devices bought through participating resellers are assigned for automatic enrollment, and apps are licensed through Apple's volume purchasing.
• Android Enterprise: Android handhelds enroll through zero-touch or managed enrollment, and apps come from managed Google Play.
• Identity provider: Administrators sign in through your identity provider, and where configured clinicians sign in to shared devices with their network credentials.
• Certificate services: Device certificates for Wi-Fi and app authentication are issued from your certificate authority through the platform.
• Clinical mobile apps: Epic Rover, Haiku, Limerick and other clinical apps are deployed with the managed configuration their vendors document.
• IT service management: Device tickets flow between your service desk and Moraph's service team, including Moraph's IT Service Management service where you use it.
• Single sign-on on devices: Shared devices can be set up to work with your badge or single sign-on service, including Moraph's Single Sign-On service built on Imprivata.

Deployment

• Vendor cloud, managed by Moraph: Jamf or Workspace ONE runs in the vendor's cloud; Moraph configures and runs it for you under a managed service agreement.
• Moraph-managed with your existing licenses: If you already license Jamf or Workspace ONE, Moraph can take over configuration and operations, subject to the vendor's terms.
• Alongside other Moraph services: Run with Moraph's Single Sign-On, Secure Messaging or Asset Tracking services so devices, sign-on and messaging are managed together.

Security and privacy

• Single sign-on: Your administrators and Moraph's staff sign in to the platform through identity providers with multi-factor authentication, and access is removed when people leave.
• Role-based access: Units see their own devices, client IT sees the fleet, and Moraph's service team works on configuration rather than on the content of devices.
• Recorded device actions: Every lock, wipe, configuration change and enrollment is recorded with the person, time and request it served.
• Controlled privileged access: Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.
• Independent audits: Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. The platform vendor's own assurance reports are available from the vendor under its terms.
• Business associate agreement: Where the service involves PHI on devices or in the platform, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Limitations

• Moraph is not Jamf or Omnissa, the vendor of Workspace ONE. The platform belongs to its vendor, and the vendor's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to the vendor's terms, and the settings available depend on what the platform and the device's operating system support.
• How a shared device is reset depends on its type and operating system. Some devices are erased and re-enrolled, others have their user session cleared; the method is agreed for each device role.
• A device that is switched off, out of Wi-Fi range or not returned cannot receive a reset or wipe until it reconnects. The exception list shows these devices; it cannot reach them.
• Location of lost devices is available only where the platform, the operating system and your policy allow it.
• Moraph does not supply, repair or replace hardware, and does not manage personally owned devices unless that is agreed in scope.
• Your organization remains responsible for its HIPAA risk analysis, device policies and breach notification decisions.
• Clinical app behavior and configuration are governed by each app's vendor; Moraph deploys apps with the settings those vendors document.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/enterprise-mobility. Purchasing routes and company information: www.moraph.com/how-to-buy.