Identity Governance

Principal workflows

• Joiners: When HR records a new hire, SailPoint creates the identity and, using the role model Moraph builds with you, provisions birthright access and the role-based access for the person's job and unit.
• Movers: When a nurse transfers wards or changes job, the role model recalculates their access: new unit access is granted and the old unit's access is removed, rather than added on top.
• Leavers: When HR records a termination, SailPoint disables accounts in connected applications, and Moraph tracks manual removals in applications that are not connected until each one is confirmed.
• Request and review: Staff request extra access through SailPoint with approvals by their manager and the application owner. Moraph runs periodic access certifications so managers confirm or revoke what their staff hold.

Who uses it

• Hospitals and health systems with an EHR and many connected clinical and business applications
• CISOs, identity and access management teams and IT security leaders
• Privacy officers responsible for the minimum necessary standard
• Nurse managers and department leaders who approve and review their staff's access
• Internal audit and compliance teams who test access controls

Reporting

• Joiner, mover and leaver results and failures
• Leavers with access still active
• Out-of-role clinical access by unit
• Certification progress and results
• Separation-of-duties violations and decisions
• Monthly service review

Features

• Unit and job based roles: SailPoint assigns access from roles built on job code, department and unit, so a nurse on one ward receives that ward's EHR access rather than a copy of a colleague's.
• Automated joiner, mover and leaver: SailPoint grants, changes and removes access in connected applications from changes in your HR system of record.
• EHR security alignment: Moraph maps your EHR's security classes, templates and department assignments to roles, so SailPoint keeps them in line with each person's current job.
• Access requests: Staff request access outside their role in SailPoint, with manager and application owner approval and the reason recorded.
• Access certifications: SailPoint certification campaigns ask managers and application owners to confirm or revoke access, with out-of-role items highlighted.
• Separation-of-duties policies: SailPoint checks for combinations of access your policy forbids, such as approving and processing the same transaction, and flags violations for decision.
• Contractor and affiliate identities: Travelers, students, agency staff and affiliated physicians managed with sponsors and end dates, so access expires when the engagement does.
• Disconnected application tracking: Applications that cannot be connected get manual provisioning and removal tasks that Moraph tracks to completion.
• Sensitive record access: Access to restricted areas such as behavioral health or substance use disorder records handled as separate, approved entitlements with stricter review.
• Role mining: Moraph analyzes current access with SailPoint's role tools to propose roles that match how people actually work, for your teams to approve.
• Access history: SailPoint records who had which access, when, and who approved it, so privacy and audit questions can be answered from the record.
• Service reviews: Monthly service reviews with your identity lead covering provisioning results, open exceptions, certification progress and changes.

Integrations

• HR system of record: Hires, transfers, job changes and terminations drive the identity lifecycle in SailPoint.
• EHR: SailPoint provisions EHR user accounts and the security classes, templates and departments mapped to each role, where the EHR supports it.
• Directory and single sign-on: Active Directory or Entra ID accounts and groups managed by SailPoint, which in turn control access through your single sign-on.
• Contractor and credentialing sources: Agency, traveler, student and affiliated physician records, including Moraph's Credentialing & Privileging Portal, so access follows privileges and end dates.
• Clinical and business applications: Connected applications such as PACS, laboratory, pharmacy and ERP systems, through SailPoint connectors where available.
• IT service management: Manual provisioning and removal tasks for disconnected applications raised as tickets in your service desk tool.
• Privacy monitoring: Role and unit data shared with your patient privacy monitoring tool, so access to records outside a person's role can be investigated.

Deployment

• Licences through Moraph: Moraph resells the SailPoint subscription and runs it as one service, subject to SailPoint's terms.
• Your existing SailPoint: If you already license SailPoint, Moraph reviews the current configuration against a new baseline and takes over its operation.
• Co-managed: Your team keeps some work, such as application onboarding or first-line support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Security and privacy

• Named Moraph administrators: Moraph staff work in your SailPoint tenant with individual accounts, the least administrative rights the service needs and multi-factor authentication; there are no shared accounts.
• Business associate agreement: Where the service involves protected health information, Moraph signs a business associate agreement before work begins.
• Role-based access: What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.
• Complete audit trail: SailPoint records requests, approvals, certifications and provisioning, and Moraph's change record links each change to its request and approval.
• People decide: Moraph's tooling may suggest roles or flag unusual access, but your managers, application owners and privacy officer make every access decision.
• Audited company-wide: Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service; service records are encrypted with keys staff cannot use without explicit, time-bound authorization. SailPoint's own attestations cover the platform.

Limitations

• Moraph is not SailPoint. SailPoint operates the platform, and SailPoint's own service commitments, roadmap, maintenance and outages apply.
• SailPoint licences are subject to SailPoint's terms. Some capabilities, and the number of identities and connectors, depend on the modules licensed.
• SailPoint governs which accounts, roles and entitlements a person holds. Which patients a user can see on a ward is enforced by the EHR's own security settings, which SailPoint assigns but does not replace.
• Automated changes only reach applications that can be connected. Others need manual tasks, which Moraph tracks but application owners complete.
• The role model is only as accurate as your HR data. Missing or wrong job codes, units and managers lead to wrong access until they are fixed at the source.
• This service is not patient privacy monitoring. It does not review which records a user actually opened.
• Moraph configures controls to support HIPAA requirements, but your organization owns the risk analysis and decides whether the controls are adequate. Moraph does not certify compliance.
• Moraph does not make access decisions or accept risk on your behalf; exceptions and violations need a decision from your named approver.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/identity-governance. Purchasing routes and company information: www.moraph.com/how-to-buy.