Healthcare · Managed platform (SailPoint)

Identity Governance

Give each clinician the access their role and unit need, and prove it

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs SailPoint identity governance for hospitals and health systems. We build role models from your HR and scheduling data so that a nurse's access to the EHR and other clinical systems follows their unit and job, changes when they transfer, and ends when they leave, supporting the HIPAA minimum necessary standard. SailPoint runs the platform; Moraph configures and operates it, runs the access reviews with your managers, and your organization decides who should have access.

The problem it solves

In most hospitals, access to the EHR and other clinical systems is granted by ticket and copied from a colleague, so people collect access as they float, transfer and change jobs. Unit-based restrictions in the EHR depend on someone assigning the right security template, and leavers keep accounts in systems that are not connected to HR. Access reviews are spreadsheets sent to managers who approve everything, and when a privacy officer or auditor asks why someone could see a record, the answer is hard to reconstruct.

  • Access is copied from colleagues and accumulates as staff transfer, float and change roles
  • EHR security templates and unit assignments are set by hand and drift from the person's actual job
  • Leavers and contractors keep access in systems not connected to HR
  • Access reviews are rubber-stamped spreadsheets that are hard to evidence

Who uses it

  • Hospitals and health systems with an EHR and many connected clinical and business applications
  • CISOs, identity and access management teams and IT security leaders
  • Privacy officers responsible for the minimum necessary standard
  • Nurse managers and department leaders who approve and review their staff's access
  • Internal audit and compliance teams who test access controls

Requirements it supports

HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))HIPAA Security Rule workforce security and information access management (45 CFR 164.308(a)(3) and (a)(4))HIPAA Security Rule access controls and audit controls (45 CFR 164.312(a) and (b))42 CFR Part 2, for substance use disorder treatment recordsNIST SP 800-66 Rev. 2, Implementing the HIPAA Security RuleHealth Industry Cybersecurity Practices (HICP), 405(d) program

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

SailPoint runs the platform, Moraph configures and operates your identity governance on it, and your organization decides who should have access.

AreaMoraphSailPointYour organization
LicensingResells SailPoint subscriptions, or works with licences you already hold, and tracks identity counts against themSets the licence terms and the modules each licence includesAgrees to SailPoint's terms and decides which modules to license
Platform availabilityTracks SailPoint service notices and tells you when an incident affects youRuns, hosts and maintains the SailPoint cloud service and its availability commitmentsKeeps a manual access process for use during an outage
ConfigurationDesigns and maintains connectors, roles, workflows and policiesProvides the configuration options the platform supportsApproves the design and every change to it
Identity dataMaps HR, scheduling and contractor data to identities and fixes aggregation errorsAggregates and correlates the data it receivesOwns the accuracy of HR and contractor records, including job codes and units
Access decisionsCarries out approved grants and revocations and follows up manual tasksEnforces the configured workflows and records decisionsDecides who should have access, through managers, application owners and the privacy officer
MonitoringMonitors provisioning, aggregation and connector health and escalates failuresRecords platform events and provides health informationFixes problems in source systems and applications, with Moraph's help
Incident responseInvestigates identity governance issues, supports your security incident response and provides access historyResponds to incidents in the SailPoint platform itselfLeads incident response and makes breach notification decisions
ChangesApplies approved changes, tests them where possible and records themMakes platform features available and documents themRequests and approves changes through named approvers
Platform updatesReviews SailPoint release notes and plans changes that affect your configuration; patches on-premises components where in scopeReleases updates to the SailPoint service on its own scheduleApproves any configuration change needed in response
Policy decisionsRecommends roles and policies with reference to HIPAA and your risk analysisNoneOwns the risk analysis, minimum necessary decisions and exceptions

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of SailPoint itself, which belongs to its vendor.

  1. Step 1

    The onboarding tracker

    During implementation, every application has a row: how it connects, who owns it and where it stands.

    ApplicationWaveConnectionOwner sign-offRoles mappedStatus
    Directory and single sign-on1ConnectorSigned offYesLive
    EHR (example)1ConnectorSigned offYesLive
    PACS (example)2ConnectorPendingIn progressTesting
    Pharmacy system (example)2Manual tasksPendingYesPlanned
    Legacy scheduling tool (example)3No connector availableNot startedNoException proposed
    During implementation, every application has a row: how it connects, who owns it and where it stands.

  2. Step 2

    Reviewing a role

    Each proposed role is reviewed with your identity lead and privacy officer before SailPoint starts assigning it.

    Role · Registered nurse, Example Medical-Surgical Unit 4

    Assigned when
    Job code RN and unit 4 West (example)
    People matching
    46
    Built from
    Current access of 46 staff
    EHR template
    Inpatient RN, unit 4 West (example)
    Sensitive record access
    None
    Status
    Awaiting privacy officer

    Entitlements in the role

    • EHR inpatient nursing, department 4 West (example)
    • Medication administration access
    • Nurse scheduling self-service
    • !Pharmacy inventory view held by 3 of 46, excluded from role
    Each proposed role is reviewed with your identity lead and privacy officer before SailPoint starts assigning it.

  3. Step 3

    Change requests

    Every change Moraph makes is requested, approved by your named approver, and recorded.

    ChangeRequested byTypeApproverStatus
    CR-1182 New role for float pool nursesIdentity governance leadRole modelPrivacy officerApproved
    CR-1185 Connect PACS (example)Moraph engineerConnectorIdentity governance leadTesting
    CR-1187 Shorten contractor default end dateIdentity governance leadPolicyCISOAwaiting approval
    CR-1190 Fix unit mapping for ICU transfersMoraph engineerFixIdentity governance leadApplied
    Every change Moraph makes is requested, approved by your named approver, and recorded.

  4. Step 4

    Triage of a provisioning failure

    When a leaver's access is not removed, Moraph investigates, records what happened and follows it to closure.

    SV-3307 · Leaver access not removed in pharmacy system (example)

    1. Leaver report shows Worker 58210 still active in pharmacy systemMoraph engineer
    2. Manual removal task found open with application ownerMoraph engineer
    3. Application owner reminded and task escalatedMoraph engineer
    4. Account disabled and task closedApplication owner
    5. Confirmed on next aggregation and noted for service reviewMoraph engineer
    When a leaver's access is not removed, Moraph investigates, records what happened and follows it to closure.

  5. Step 5

    An access certification

    Moraph runs the campaign and chases reviewers; managers make the decisions, with out-of-role access highlighted.

    Quarterly clinical access review · Example Health System

    Reviewers
    212 managers
    Items
    18,440
    Certified
    14,102
    Revoked
    611
    Outstanding
    3,727
    Out-of-role items flagged
    1,094

    Follow-up

    • Reminders sent to 38 reviewers with open items
    • 9 reviewers approved every item; listed for the identity lead
    • 611 revocations scheduled for provisioning
    Moraph runs the campaign and chases reviewers; managers make the decisions, with out-of-role access highlighted.

  6. Step 6

    The monthly service review

    Each month, Moraph and your identity lead review results, exceptions and changes, and agree priorities.

    AreaThis monthPrevious monthOpen itemsNote
    Joiners processed1841620
    Movers processed971102Unit codes missing in HR
    Leavers processed1211304Manual removals overdue
    Changes applied641CR-1187 awaiting approval
    SailPoint service notices100Maintenance, no impact
    Each month, Moraph and your identity lead review results, exceptions and changes, and agree priorities.

Workflows

The principal workflows

  1. Joiners

    When HR records a new hire, SailPoint creates the identity and, using the role model Moraph builds with you, provisions birthright access and the role-based access for the person's job and unit.

    • New hire record arrives from HR with job code, department and unit
    • SailPoint matches the person to the roles defined for that job and unit
    • Accounts and entitlements provisioned to connected applications
    • Access needing manual setup sent as tickets to the application team
    • Manager notified of the access granted and any items still pending

  2. Movers

    When a nurse transfers wards or changes job, the role model recalculates their access: new unit access is granted and the old unit's access is removed, rather than added on top.

    • HR or scheduling change detected for job, department or unit
    • SailPoint compares current access with the new role
    • New access provisioned and access no longer needed scheduled for removal
    • Exceptions, such as a transition period, requested and approved by the manager
    • Change recorded for the access history

  3. Leavers

    When HR records a termination, SailPoint disables accounts in connected applications, and Moraph tracks manual removals in applications that are not connected until each one is confirmed.

    • Termination or end of contract recorded in HR or the contractor system
    • Accounts disabled in connected applications under the agreed timing
    • Manual removal tasks raised for applications not connected
    • Moraph follows up open removal tasks with application owners
    • Leaver report shows any access not yet removed

  4. Request and review

    Staff request extra access through SailPoint with approvals by their manager and the application owner. Moraph runs periodic access certifications so managers confirm or revoke what their staff hold.

    • Staff request additional access with a reason
    • Manager and application owner approve or deny
    • Certification campaigns launched on the schedule your policy sets
    • Managers confirm or revoke each person's access, with out-of-role access highlighted
    • Moraph carries out revocations and reports the campaign results

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Identity governance lead

IAM manager, director of information security, CISO or delegate

Owns identity governance for the organization and makes the decisions Moraph carries out.

Sees

  • The role model, policies and connected applications
  • Provisioning results, exceptions and open manual tasks
  • Certification campaign progress and results
  • Moraph's change record and service reports

Does

  • Approves the role model and changes to it
  • Approves configuration changes requested through Moraph
  • Sets certification schedules and scope
  • Decides on escalated exceptions and policy violations
  • Attends monthly service reviews

Cannot

  • Approve a change they requested without a second approver your policy names
  • Edit Moraph's change record or SailPoint's audit history
Approvals
Approves role model and configuration changes, certification campaigns and policy exceptions.
Notified about
Changes waiting for approval, escalated violations, failed provisioning and overdue certifications.

Privacy officer

Chief privacy officer, HIPAA privacy officer, compliance officer

Makes sure access to patient information follows the minimum necessary standard.

Sees

  • Roles and the clinical access each one grants
  • Who holds access to sensitive record categories
  • Certification results for clinical applications

Does

  • Defines minimum necessary requirements for roles
  • Approves access to sensitive record categories
  • Reviews out-of-role clinical access
  • Requests targeted reviews after a privacy concern

Cannot

  • Change SailPoint configuration directly
  • Approve their own access requests
Approvals
Approves roles that grant broad clinical access and individual access to sensitive record categories.
Notified about
Requests for sensitive access and certification results showing out-of-role clinical access.

Manager or nurse manager

Nurse manager, department director, supervisor

Confirms that the people they manage have the access their work needs and no more.

Sees

  • Their staff's current access and its source, role or request
  • Pending requests from their staff
  • Their certification tasks

Does

  • Approves or denies access requests from their staff
  • Certifies or revokes their staff's access
  • Requests transition access when staff move between units
  • Sponsors contractors and students with end dates

Cannot

  • Approve access for themselves
  • See staff outside their reporting line
  • Change roles
Approvals
Their approvals are the first step; application owners and the privacy officer approve where your policy requires.
Notified about
Requests waiting, certification campaigns assigned and reminders, and sponsored accounts about to expire.

Application owner

EHR security analyst, application manager, department system owner

Controls who can use their application and what each entitlement allows.

Sees

  • Entitlements in their application and who holds them
  • Requests for their application
  • Manual provisioning tasks for disconnected applications

Does

  • Approves access to their application
  • Certifies entitlements in their application
  • Describes entitlements in plain language for reviewers
  • Completes manual provisioning and removal tasks

Cannot

  • Approve access for themselves
  • Change the role model without the identity governance lead
Approvals
Approves requests for their application after the manager.
Notified about
Requests waiting, manual tasks assigned and overdue removals.

Moraph service engineer

Moraph identity engineer, managed service analyst

Configures, monitors and operates SailPoint for your organization under the agreed procedures.

Sees

  • SailPoint configuration, connectors and provisioning results
  • Aggregation and provisioning errors
  • The change record and service tickets

Does

  • Builds and maintains connectors, roles, workflows and policies
  • Applies approved changes and records them
  • Monitors provisioning and aggregation and fixes failures
  • Follows up open manual tasks with application owners
  • Runs certification campaigns and carries out revocations
  • Prepares the monthly service review

Cannot

  • Approve access or changes on your behalf
  • Grant themselves access to your clinical applications
  • Make policy decisions or accept risk
Approvals
Every configuration change needs your identity governance lead's approval; emergency changes follow the agreed procedure and are reviewed afterward.
Notified about
Provisioning and connector failures, approved changes ready to apply and certification deadlines.

Auditor (read-only)

Internal auditor, external auditor, compliance reviewer (under temporary access)

Tests access controls using the records SailPoint and Moraph keep.

Sees

  • Access history and approvals within the scope granted
  • Certification results
  • The change record

Does

  • Searches and reads records within scope
  • Receives exports prepared for the audit

Cannot

  • Change, approve or revoke anything
  • Keep access after it expires
Approvals
Access is approved by the identity governance lead with a scope and end date.
Notified about
Nothing by default.

Permissions at a glance

ActionIG leadPrivacyManagerApp ownerMoraph eng.Auditor
Approve role model changesApprovesApprovesNo accessView onlyNo accessView only
Configure SailPointApprovesNo accessNo accessNo accessFullNo access
Request accessOwn work onlyOwn work onlyOwn work onlyOwn work onlyNo accessNo access
Approve staff access requestsFullNo accessOwn work onlyOwn work onlyNo accessNo access
Approve sensitive record accessView onlyApprovesNo accessNo accessNo accessNo access
Certify accessFullView onlyOwn work onlyOwn work onlyNo accessView only
Launch certification campaignsApprovesNo accessNo accessNo accessFullNo access
Decide policy violationsApprovesApprovesNo accessNo accessView onlyView only
Complete manual removal tasksView onlyNo accessNo accessOwn work onlyFullNo access
View access historyView onlyView onlyOwn work onlyOwn work onlyView onlyView only
Sponsor contractor accountsFullNo accessOwn work onlyNo accessNo accessNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Moraph engineers operate SailPoint but never approve access or changes; every change to roles, policies or configuration is approved by your named approvers.
  • Nobody approves their own access request, and access to sensitive record categories needs the privacy officer's approval in addition to the manager's.
  • Roles in the service are agreed with you during implementation and recorded in the responsibilities for the service, including who may approve emergency changes.
  • Moraph engineers use individual named accounts with the least administrative rights the service needs, and their activity is recorded in SailPoint and in Moraph's change record.

Features

What it does

Unit and job based roles

SailPoint assigns access from roles built on job code, department and unit, so a nurse on one ward receives that ward's EHR access rather than a copy of a colleague's.

Automated joiner, mover and leaver

SailPoint grants, changes and removes access in connected applications from changes in your HR system of record.

EHR security alignment

Moraph maps your EHR's security classes, templates and department assignments to roles, so SailPoint keeps them in line with each person's current job.

Access requests

Staff request access outside their role in SailPoint, with manager and application owner approval and the reason recorded.

Access certifications

SailPoint certification campaigns ask managers and application owners to confirm or revoke access, with out-of-role items highlighted.

Separation-of-duties policies

SailPoint checks for combinations of access your policy forbids, such as approving and processing the same transaction, and flags violations for decision.

Contractor and affiliate identities

Travelers, students, agency staff and affiliated physicians managed with sponsors and end dates, so access expires when the engagement does.

Disconnected application tracking

Applications that cannot be connected get manual provisioning and removal tasks that Moraph tracks to completion.

Sensitive record access

Access to restricted areas such as behavioral health or substance use disorder records handled as separate, approved entitlements with stricter review.

Role mining

Moraph analyzes current access with SailPoint's role tools to propose roles that match how people actually work, for your teams to approve.

Access history

SailPoint records who had which access, when, and who approved it, so privacy and audit questions can be answered from the record.

Service reviews

Monthly service reviews with your identity lead covering provisioning results, open exceptions, certification progress and changes.

Integrations

How it connects to your systems

Connects toHowWhat flows
HR system of recordHires, transfers, job changes and terminations drive the identity lifecycle in SailPoint.In: workers, job codes, departments, units, managers and employment status.
EHRSailPoint provisions EHR user accounts and the security classes, templates and departments mapped to each role, where the EHR supports it.Out: account and role assignments. In: current accounts and entitlements for review.
Directory and single sign-onActive Directory or Entra ID accounts and groups managed by SailPoint, which in turn control access through your single sign-on.Out: accounts and group memberships. In: current accounts and groups.
Contractor and credentialing sourcesAgency, traveler, student and affiliated physician records, including Moraph's Credentialing & Privileging Portal, so access follows privileges and end dates.In: non-employee identities, sponsors, privileges and end dates.
Clinical and business applicationsConnected applications such as PACS, laboratory, pharmacy and ERP systems, through SailPoint connectors where available.Out: accounts and entitlements. In: current access for review.
IT service managementManual provisioning and removal tasks for disconnected applications raised as tickets in your service desk tool.Out: tasks. In: completion status.
Privacy monitoringRole and unit data shared with your patient privacy monitoring tool, so access to records outside a person's role can be investigated.Out: identities, roles and units.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Named Moraph administrators

Moraph staff work in your SailPoint tenant with individual accounts, the least administrative rights the service needs and multi-factor authentication; there are no shared accounts.

Business associate agreement

Where the service involves protected health information, Moraph signs a business associate agreement before work begins.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Complete audit trail

SailPoint records requests, approvals, certifications and provisioning, and Moraph's change record links each change to its request and approval.

People decide

Moraph's tooling may suggest roles or flag unusual access, but your managers, application owners and privacy officer make every access decision.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service; service records are encrypted with keys staff cannot use without explicit, time-bound authorization. SailPoint's own attestations cover the platform.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Provisioning results

For identity governance lead, Moraph engineers

Joiner, mover and leaver events processed, accounts created, changed and removed, and failures with their cause.

Break down by
Event type, Application, Result, Period
Delivered as
Live view; monthly service review pack
Used for
Confirming the lifecycle is working and fixing failures.

Open manual tasks

For application owners, identity governance lead

Manual provisioning and removal tasks for disconnected applications, with age and owner.

Break down by
Application, Task type, Owner, Age
Delivered as
Live view; scheduled email
Used for
Making sure removals in disconnected applications are not forgotten.

Leaver access

For identity governance lead, security team

Terminated identities with any account or entitlement still active, and the reason.

Break down by
Application, Days since termination, Worker type
Delivered as
Live view; scheduled email
Used for
Closing access that should already have ended.

Contractor and sponsored accounts

For sponsors and the identity governance lead

Non-employee identities with their sponsor, access and end date.

Break down by
Worker type, Sponsor, End date window
Delivered as
Live view; scheduled email
Used for
Renewing or ending access before engagements expire.

Privacy and compliance

Out-of-role clinical access

For privacy officer, identity governance lead

People holding clinical access that is not part of their current role, with how it was granted.

Break down by
Department or unit, Application, Grant source, Age
Delivered as
Live view; monthly service review pack
Used for
Targeting minimum necessary reviews where access has drifted.

Sensitive record access

For privacy officer

Who holds access to restricted record categories, who approved it and when it was last certified.

Break down by
Record category, Department, Approver
Delivered as
Live view; PDF export
Used for
Evidencing control over the most sensitive records.

Separation-of-duties violations

For identity governance lead, compliance

Policy violations found, the decision on each, and any approved exceptions with their end dates.

Break down by
Policy, Decision, Department
Delivered as
Live view; CSV export
Used for
Showing conflicts are found and decided.

Certification

Certification campaign progress

For identity governance lead, managers

Items certified, revoked and outstanding for each campaign, by reviewer.

Break down by
Campaign, Reviewer, Department, Status
Delivered as
Live view; scheduled email
Used for
Getting campaigns finished on time.

Certification results

For auditors, compliance, privacy officer

Completed campaigns with decisions, revocations carried out and reviewers who approved everything.

Break down by
Campaign, Application, Decision, Reviewer
Delivered as
PDF and CSV export
Used for
Audit evidence and finding reviews that need a second look.

Service

Monthly service review

For identity governance lead, IT leadership

Provisioning results, open exceptions and tasks, changes made, certification status and platform notices for the month.

Break down by
Month, Area, Status
Delivered as
PDF; reviewed in a monthly meeting
Used for
Governing the service and agreeing priorities.

Change record

For identity governance lead, auditors

Every configuration change with its request, approver, test result and the date it was applied.

Break down by
Change type, Approver, Date range
Delivered as
On request; CSV and PDF export
Used for
Evidencing change control over the identity platform.

Exports, access and evidence

  • Operational reports come from SailPoint's own reporting and from Moraph's service records; where a report is SailPoint's, it is produced as the platform supports it.
  • Reports can be exported to CSV or PDF and scheduled by email for the people entitled to see them.
  • Managers see only their own staff, application owners only their applications, and auditors only the scope they are granted.
  • The monthly service review pack brings the key reports together and is the basis for the service meeting with your identity governance lead.
  • Certification and change evidence is kept for the retention period agreed in the contract, and running or exporting a report is recorded.

Deployment

Where and how it runs

Licences through Moraph

Moraph resells the SailPoint subscription and runs it as one service, subject to SailPoint's terms.

Your existing SailPoint

If you already license SailPoint, Moraph reviews the current configuration against a new baseline and takes over its operation.

Co-managed

Your team keeps some work, such as application onboarding or first-line support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We review your HR data, applications, EHR security model and current provisioning process, and agree which applications are connected first.

Identity data

HR, scheduling and contractor sources are connected and mapped, and data quality issues such as missing units or managers are listed for your HR team to fix.

Role model

Roles by job and unit are proposed from your current access and your minimum necessary requirements, and approved by your identity governance lead and privacy officer.

Application onboarding

Applications are connected in agreed waves, starting with the directory and EHR, with each application owner signing off before go-live.

First certification

A first access certification cleans up existing access before automated roles take over, with managers trained on how to review.

Transition to service

The responsibilities, approvers, emergency procedures and service review schedule are confirmed, and Moraph takes over day-to-day operation.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not SailPoint. SailPoint operates the platform, and SailPoint's own service commitments, roadmap, maintenance and outages apply.
  • SailPoint licences are subject to SailPoint's terms. Some capabilities, and the number of identities and connectors, depend on the modules licensed.
  • SailPoint governs which accounts, roles and entitlements a person holds. Which patients a user can see on a ward is enforced by the EHR's own security settings, which SailPoint assigns but does not replace.
  • Automated changes only reach applications that can be connected. Others need manual tasks, which Moraph tracks but application owners complete.
  • The role model is only as accurate as your HR data. Missing or wrong job codes, units and managers lead to wrong access until they are fixed at the source.
  • This service is not patient privacy monitoring. It does not review which records a user actually opened.
  • Moraph configures controls to support HIPAA requirements, but your organization owns the risk analysis and decides whether the controls are adequate. Moraph does not certify compliance.
  • Moraph does not make access decisions or accept risk on your behalf; exceptions and violations need a decision from your named approver.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Pick one nursing unit and compare the access its staff hold today with the role Moraph would propose
  2. Follow a transfer between two units and confirm old access is removed, not just new access added
  3. Check how a leaver is handled in an application that cannot be connected
  4. Review a sample certification as a nurse manager and judge whether it is clear enough to decide
  5. Read the responsibilities table and confirm the split with SailPoint and Moraph suits your team
  6. Ask how emergency access changes are approved and reviewed

Questions

Frequently asked questions

Does SailPoint control which patients a nurse can see?

Not directly. SailPoint assigns the EHR roles, security templates and department access for each person's job and unit, and the EHR enforces which records they can open. Keeping those assignments right is what this service does.

Can you take over our existing SailPoint?

Yes. Moraph reviews the current configuration against a new baseline, agrees the fixes with you and then takes over operation.

Who decides who gets access?

Your organization does, through managers, application owners and the privacy officer. Moraph configures the workflows and carries out decisions.

How is it priced?

The SailPoint subscription plus a managed service fee, usually based on the number of identities and connected applications, with implementation charged separately. See Working with Moraph for what drives a quotation.

Will you sign a business associate agreement?

Yes, where the service involves protected health information.

What happens if SailPoint has an outage?

SailPoint's own service commitments apply. Moraph tells you when an incident affects you and supports your manual access process until the service returns.

Next steps

Evaluate Identity Governance

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Identity Governance guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Identity Governance support guide.

Related products