Healthcare · Managed platform (FairWarning)

Patient Privacy Monitoring

Find staff looking at records they have no reason to see, with FairWarning run by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs FairWarning patient privacy monitoring for hospitals and health systems. We connect FairWarning to your EHR access logs and HR data, configure it to flag access such as staff opening the records of coworkers, family members, neighbors or well-known patients, and triage what it raises so your privacy team works the cases that need a decision. FairWarning provides the platform; Moraph operates it; your organization investigates, decides on sanctions and determines whether a breach occurred.

The problem it solves

Every day thousands of staff open patient records for legitimate reasons, which makes the few who look without a reason hard to find. Privacy teams are expected to review EHR access regularly, respond quickly when a patient or the press asks who looked at a record, and show that sanctions are applied consistently. Reviewing raw access logs by hand is not practical, and a monitoring platform is only useful if its data feeds stay healthy, its rules are tuned to your organization and someone works its alerts every day.

  • Access logs hold millions of entries, and inappropriate access hides among legitimate care
  • Snooping on coworkers, relatives, neighbors and well-known patients is found only when someone complains
  • Data feeds from the EHR and HR systems break or drift without anyone noticing
  • Investigations, findings and sanctions are recorded inconsistently, which is hard to defend

Who uses it

  • Privacy officers and privacy teams at hospitals and health systems
  • Compliance officers who report on privacy to leadership and the board
  • Human resources partners who apply sanctions after a finding
  • EHR and IT teams who supply access logs and user data
  • Internal audit, who need evidence that access is reviewed

Requirements it supports

HIPAA Security Rule information system activity review (45 CFR 164.308(a)(1)(ii)(D)) and audit controls (45 CFR 164.312(b))HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))HIPAA sanctions requirements (45 CFR 164.530(e) and 164.308(a)(1)(ii)(C))HIPAA Breach Notification Rule (45 CFR 164.400-414)Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)State medical privacy laws, such as California Health and Safety Code Section 1280.15

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

FairWarning provides and supports the monitoring platform, Moraph configures and runs it and triages its alerts, and your organization owns the investigations, findings, sanctions and breach decisions.

AreaMoraphFairWarningYour organization
LicensingResells FairWarning licences sized to your users and applications monitored, and tracks renewalsSets licence terms and entitlementsApproves the licence scope and applications covered
Platform availabilityMonitors platform health and raises platform issues with FairWarningOperates the FairWarning service under its own service commitmentsProvides network access for data feeds from your systems
Data feedsSpecifies, connects and monitors feeds of access logs, HR data and patient demographics, and chases failuresProvides the connectors and data formats the platform acceptsProduces the extracts from your EHR, HR and registration systems and fixes source problems
Detection configurationConfigures and tunes rules for coworker, family, neighbor, VIP and other inappropriate access, and documents every versionProvides the detection engine, analytics and standard rule typesDecides what counts as a concern, which patients are protected and the thresholds to use
Identity and accessConfigures investigator and reviewer roles and links them to your directoryProvides the role model in the platformDecides who may see alerts, cases and the patient and employee details in them
Alert triageReviews alerts, closes those with a documented legitimate reason and escalates the rest with evidenceGenerates alerts from access activityInvestigates escalated alerts and records findings
Sanctions and breachesProvides access history and case evidence to your privacy and HR teamsSupports platform defects through its own support channelDecides on sanctions, breach determinations and any patient, HHS, state or media notification
ChangesTests rule changes against recent activity and applies them after approvalChanges the product under its own release termsApproves rule changes and new protected-patient groups
Platform updatesReviews FairWarning release notes and adjusts configuration where updates affect your rulesPublishes updates to the serviceApproves configuration changes that follow an update
Patient access requestsPrepares access reports for a patient's record when your privacy team asksProvides access reporting in the platformResponds to the patient and decides what is disclosed

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of FairWarning itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    Onboarding is tracked by data feed and decision, with each task's owner, so extracts on your side are visible.

    TaskOwnerStatus
    EHR access log extract builtYour EHR analystDone
    HR extract with addresses and managersYour HRIS analystDone
    Account-to-employee mapping checkedMoraph engineer412 accounts unmatched
    Protected-patient groups approvedYour privacy officerIn progress
    Rule baseline reviewedYour privacy officerNot started
    Triage runbook agreedYour privacy officerNot started
    Onboarding is tracked by data feed and decision, with each task's owner, so extracts on your side are visible.

  2. Step 2

    Rule baseline review

    Before handover, Moraph walks your privacy officer through the rule baseline and records the decisions still open.

    Rule baseline · Example Health System (fictional)

    Applications monitored
    EHR and 2 ancillary systems
    Users attributed to employees
    97 percent
    Relationship rules
    Coworker, same last name, same address, nearby address
    Self access
    Flag for review
    Protected patients
    Board, executives, public figures
    Alerts in tuning period
    Higher than your team can review

    Decisions needed

    • Set the distance for the nearby-address rule
    • Decide whether access with a scheduled appointment closes automatically
    • Name designees who may see protected-patient alerts
    Before handover, Moraph walks your privacy officer through the rule baseline and records the decisions still open.

  3. Step 3

    Rule change request

    Rule changes go through a request, a test against recent activity and your approval before Moraph applies them.

    CR-0291 · Exclude registration staff from the same-last-name rule at check-in

    1. Change proposed after reviewing closure reasonsMoraph analyst
    2. Change tested against the last 30 days of accessMoraph engineer
    3. Test shows no substantiated case would have been missedMoraph engineer
    4. Change approvedYour privacy officer
    5. Change applied and version recordedMoraph engineer
    Rule changes go through a request, a test against recent activity and your approval before Moraph applies them.

  4. Step 4

    Alert triage

    Each alert is checked for a legitimate reason; without one, it goes to your privacy team with the evidence assembled.

    PA-58190 · Employee 20931 opened the record of Patient 55120

    Rule
    Nearby address
    Employee department
    Outpatient Billing
    Relationship found
    Addresses on the same street
    Patient encounters at time of access
    None
    Sections viewed
    Demographics, problem list, notes
    Legitimate reason found
    None documented

    Evidence attached

    • Access history for Employee 20931 over 90 days
    • No billing work queue item for Patient 55120
    • One earlier alert for this employee, closed with a reason
    Each alert is checked for a legitimate reason; without one, it goes to your privacy team with the evidence assembled.

  5. Step 5

    Monthly service review

    Each month Moraph reviews alerts, escalations, feed health and changes with your privacy officer and brings the decisions that are due.

    Monthly service review · sample month

    Alerts triaged
    1,214
    Closed with a legitimate reason
    1,163
    Escalated to your privacy team
    51
    Substantiated findings recorded
    7
    Feed gaps
    1 day of ancillary system logs late
    Rule changes applied
    2

    Decisions needed

    • Approve adding a newly elected board member to protected patients
    • Agree a sample size for closure quality review
    • Decide whether to bring the pharmacy system into scope
    Each month Moraph reviews alerts, escalations, feed health and changes with your privacy officer and brings the decisions that are due.

  6. Step 6

    Case access review

    Access to alerts, cases and protected-patient reports is reviewed with you, and anything no longer needed is removed.

    PersonRoleProtected patientsLast usedDecision
    Privacy User 02 (fictional)Privacy investigatorNoTodayKeep
    Privacy User 05 (fictional)Privacy officer designeeYesThis weekKeep
    Analyst User 11 (fictional)Moraph analystNoTodayKeep
    HR User 08 (fictional)HR partnerNoLeft HR team last monthRemove
    Access to alerts, cases and protected-patient reports is reviewed with you, and anything no longer needed is removed.

Workflows

The principal workflows

  1. Collect

    Access logs from your EHR and other clinical applications are sent to FairWarning with HR and patient demographic data, so each access can be compared with who the user is and who the patient is.

    • EHR and application access logs extracted on the agreed schedule
    • HR data supplies each employee's department, role, manager and address
    • Registration data supplies patient names, addresses and protected flags
    • User accounts matched to employees so access is attributed to a person
    • Moraph checks each feed arrives complete and chases any failure

  2. Detect

    FairWarning compares access with the rules and analytics configured for your organization and raises alerts for patterns such as staff opening the records of coworkers, family members, neighbors or patients you have marked as protected.

    • Rules for coworker, same last name, same address, nearby address and self access applied
    • Access to protected patients, such as public figures or board members, flagged
    • FairWarning's analytics score unusual access patterns for review
    • Alerts created with the access details and the reason they fired
    • Repeated alerts for the same user grouped together

  3. Triage

    Moraph analysts review each alert, look for a documented legitimate reason such as a scheduled appointment or care team assignment, and escalate the rest to your privacy team with the evidence assembled.

    • Analyst reviews the alert, the user's role and the patient's encounters
    • Legitimate reasons recorded and the alert closed with a reason code
    • Alerts without a clear reason escalated to your privacy team
    • Evidence attached: access history, relationship found and encounter context
    • Closed alerts sampled by your privacy team for quality review

  4. Investigate and resolve

    Your privacy investigators work escalated cases, interview where needed and record a finding. HR and managers decide on sanctions, and your privacy officer decides whether a breach occurred.

    • Investigator reviews the evidence and gathers more if needed
    • Employee and manager interviewed under your procedures
    • Finding recorded with its rationale
    • Sanction decided by HR and the manager under your sanctions policy
    • Breach determination and any notifications recorded by the privacy officer

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Privacy officer

Chief privacy officer, HIPAA privacy officer, privacy and compliance director

Owns the privacy monitoring program: what is monitored, how strictly, and the decisions that follow a finding.

Sees

  • All rules, protected-patient groups and their versions
  • Alert volumes, escalations, findings and sanctions
  • Every case and its evidence
  • Monthly service reports

Does

  • Approves rules, thresholds and protected-patient groups
  • Agrees the triage runbook and what counts as a legitimate reason
  • Reviews findings and decides whether a breach occurred
  • Records notifications to patients, HHS, state agencies or the media
  • Samples alerts Moraph has closed for quality review
  • Reviews the monthly service report with Moraph

Cannot

  • Apply rule changes directly; Moraph applies approved changes
  • Edit or delete case history or the audit trail
  • Investigate a case in which they are the employee or the patient
Approvals
Approves every rule change, protected-patient group and runbook change, and every breach determination; changes they propose themselves need a second approver your organization names.
Notified about
Escalated cases involving protected patients, findings ready for decision, feed failures and changes waiting for approval.

Privacy investigator

Privacy analyst, privacy investigator, compliance specialist

Investigates escalated alerts and records a finding with its rationale.

Sees

  • Cases assigned to them and the evidence Moraph attached
  • The user's access history and the patient's encounters relevant to the case
  • Earlier cases for the same employee, where their role allows

Does

  • Reviews evidence and requests further access history
  • Contacts managers and interviews employees under your procedures
  • Records the finding and its rationale
  • Refers substantiated findings to HR
  • Prepares patient access reports for complaints

Cannot

  • Change rules or protected-patient groups
  • Work a case involving themselves, a relative or a direct colleague
  • Decide sanctions or breach determinations
Approvals
Findings are reviewed by the privacy officer before referral to HR or any breach assessment.
Notified about
Cases assigned to them, evidence requests completed and cases returned with comments.

HR partner

HR business partner, employee relations specialist

Decides, with the employee's manager, the sanction that follows a substantiated finding, under your sanctions policy.

Sees

  • Findings referred to HR and the evidence summary
  • The employee's earlier findings and sanctions
  • Sanctions recorded across the organization by category

Does

  • Reviews referred findings with the employee's manager
  • Decides and records the sanction
  • Records retraining or other follow-up
  • Closes the referral when actions are complete

Cannot

  • See alerts or cases not referred to HR
  • Change a finding
  • Change rules or configuration
Approvals
Sanctions follow your HR policy and approval process; the service records the outcome.
Notified about
New referrals and referrals approaching the follow-up date your policy sets.

EHR and data administrator

EHR analyst, integration analyst, HRIS analyst

Keeps the access log, HR and registration extracts flowing to FairWarning and fixes problems at the source.

Sees

  • Feed specifications and schedules
  • Feed health results and failure tickets
  • Data quality issues found in their extracts

Does

  • Builds and maintains extracts from the EHR, HR and registration systems
  • Fixes extract failures and data quality problems
  • Tells Moraph before EHR upgrades or changes that affect logs
  • Maintains the mapping of system accounts to employees

Cannot

  • See alerts, cases or findings
  • Change rules
Approvals
Extract changes follow your organization's change process.
Notified about
Feed failures, late files and data quality issues in their extracts.

Moraph privacy analyst

Moraph privacy analyst, healthcare compliance analyst

Works the alert queue under your runbook so your team handles only the alerts that need a decision.

Sees

  • Alerts and the access details behind them
  • The user's role and department and the patient's encounters relevant to the alert
  • Earlier alerts for the same user

Does

  • Reviews each alert for a documented legitimate reason
  • Closes alerts with a reason code and note under the runbook
  • Escalates alerts without a clear reason, with evidence attached
  • Prepares patient access reports when your privacy team asks
  • Flags rules that produce many alerts with legitimate reasons for tuning

Cannot

  • Contact employees, managers or patients
  • Record findings, sanctions or breach determinations
  • Close alerts on protected patients without your privacy team's review, unless the runbook allows it
Approvals
Their closures are sampled by your privacy officer, and alerts the runbook reserves are escalated rather than closed.
Notified about
New alerts, alerts approaching the age the runbook sets, and closures returned after quality review.

Moraph platform engineer

Moraph platform engineer, healthcare integration engineer

Configures FairWarning and its data feeds so detection reflects your decisions and your data.

Sees

  • Rule configuration and its version history
  • Feed health and data quality results
  • FairWarning release notes and service notices

Does

  • Configures relationship, protected-patient and other rules
  • Tests rule changes against recent activity and reports the result
  • Applies approved changes and records each version
  • Connects and monitors data feeds
  • Raises platform issues with FairWarning support

Cannot

  • Apply a rule change without your approval
  • Work alerts or cases
  • Change source systems or extracts
Approvals
Every rule and protected-patient change is approved by your privacy officer first.
Notified about
Feed failures, approved changes ready to apply and FairWarning service notices.

Auditor (read-only)

Internal auditor, external auditor, compliance reviewer

Reviews the program's rules, decisions and evidence without being able to change anything.

Sees

  • Rule versions and approval records
  • Cases, findings and sanctions within the scope granted
  • Monthly service reports and the audit trail

Does

  • Searches and reads records within their scope
  • Exports reports they have been given access to, with each export logged

Cannot

  • Change, approve or delete anything
  • See records outside the scope and dates granted
  • Keep access after it expires
Approvals
Their access is approved by the privacy officer, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

ActionPrivacy officerInvestigatorHR partnerEHR adminMoraph analystMoraph engineerAuditor
Approve rules and thresholdsApprovesNo accessNo accessNo accessNo accessNo accessNo access
Configure rules and data feedsNo accessNo accessNo accessNo accessNo accessFullNo access
Maintain protected-patient groupsApprovesNo accessNo accessNo accessNo accessFullNo access
Provide access log and HR extractsNo accessNo accessNo accessFullNo accessView onlyNo access
Triage and close alertsFullView onlyNo accessNo accessFullNo accessNo access
Work investigationsFullOwn work onlyNo accessNo accessNo accessNo accessNo access
View patient and employee detailsFullOwn work onlyOwn work onlyNo accessOwn work onlyNo accessView only
Record a findingApprovesOwn work onlyNo accessNo accessNo accessNo accessNo access
Record a sanctionView onlyNo accessFullNo accessNo accessNo accessNo access
Record a breach determinationFullNo accessNo accessNo accessNo accessNo accessNo access
View reportsView onlyView onlyOwn work onlyOwn work onlyView onlyView onlyView only
View audit trailView onlyNo accessNo accessNo accessView onlyView onlyView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Nobody investigates themselves or people close to them: investigators and analysts are kept off cases involving their own records, relatives or direct colleagues, and such cases go to the privacy officer or a designee.
  • The triage runbook sets what Moraph analysts may close without asking, what counts as a documented legitimate reason, and which alerts, such as those on protected patients, always go to your privacy team.
  • Moraph identifies and documents; your organization decides. Findings, sanctions and breach determinations are recorded only by your staff.
  • Every view of a case or of patient and employee details is logged, including views by your privacy team and by Moraph. Auditors get temporary read-only access with a scope and an end date.

Features

What it does

EHR access monitoring

FairWarning reviews access logs from your EHR and, where connected, other clinical applications, so access is reviewed as a matter of routine rather than only after a complaint.

Relationship rules

Rules that flag staff opening the records of coworkers, people with the same last name or address, and neighbors, configured from your HR and registration data.

Protected patients

Patients your privacy officer names, such as public figures, board members or staff, have their access reviewed more closely.

Self and household access

Staff opening their own record or those of their household are flagged under the policy your organization sets.

Unusual pattern scoring

FairWarning's analytics score access that is unusual for a user's role and history; the score prompts review, and a person decides.

Alert triage by Moraph

Moraph analysts work the alert queue, close those with a documented legitimate reason and escalate the rest with evidence.

Case management

Escalated alerts become cases in FairWarning for your investigators, with notes, interviews, findings and attachments kept together.

Patient access reports

A report of who opened a patient's record and when, prepared for your privacy team to use in responding to a complaint or request.

Feed health monitoring

Moraph checks each access log and HR feed for missing or late data, so gaps in monitoring are found and fixed.

Rule testing

Proposed rule changes are run against recent activity before they go live, and the result kept as evidence of the decision.

Sanctions consistency

Findings and the sanctions your HR team applies are recorded by category, so your privacy officer can show that similar cases are treated alike.

Investigator oversight

Every view of a case and of patient or employee details is logged, so access by the privacy team is itself reviewable.

Integrations

How it connects to your systems

Connects toHowWhat flows
EHR access logsAccess audit logs from your EHR, such as Epic, Oracle Health or MEDITECH, extracted on the agreed schedule in a format FairWarning accepts.In: who accessed which record, when, from where and what they did.
Other clinical applicationsAccess logs from other systems that hold PHI, such as imaging, laboratory or pharmacy systems, where FairWarning supports them and they are in scope.In: application access events.
HR systemEmployee details from your HR system used to attribute access and find relationships.In: employee name, address, department, job title, manager and status.
Registration and patient demographicsPatient names, addresses and protected flags from registration, used for relationship and protected-patient rules.In: patient demographics and encounter context.
DirectoryMapping of EHR and application accounts to employees, so each access is attributed to a person.In: account identifiers and their owners.
Single sign-onYour privacy team signs in to FairWarning and Moraph's service portal through your identity provider (SAML).In: user identity and group membership for role assignment.
Service deskFeed failures and change requests flow between Moraph and your IT service management tool.In and out: tickets, status and resolution notes.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your privacy team signs in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Triage, investigation, sanctions and configuration are separate roles, and each sees only the patient and employee details its work needs.

Business associate agreement

Because the service handles PHI, Moraph signs a business associate agreement with you; your agreement with FairWarning covers its own handling.

Encryption and keys

Case evidence and feed data handled by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization outside the agreed triage role.

Complete audit trail

Every alert decision, case view, finding and configuration change is logged with the person and time, and cannot be edited.

People decide

Analytics and scores suggest what to review; Moraph analysts and your privacy team decide, and every decision has a named person and a reason.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operational

Alert queue

For moraph analysts and your privacy officer

Open alerts with their rule, age, user department and whether a protected patient is involved.

Break down by
Rule, Age, Department, Protected patient
Delivered as
Live view; CSV export
Used for
Making sure every alert is triaged within the period the runbook sets.

Open investigations

For privacy officer and investigators

Escalated cases with their investigator, status, age and next step.

Break down by
Investigator, Status, Rule, Age band
Delivered as
Live view; scheduled email
Used for
Keeping investigations moving and balancing the workload.

Feed health

For eHR and data administrators, Moraph engineer

Each data feed's last arrival, record counts against expected volumes and any failures or gaps.

Break down by
Feed, Source system, Date, Issue type
Delivered as
Live view; alerts by email on failure
Used for
Finding and fixing gaps in monitoring before they become a blind spot.

Program

Alert outcomes

For privacy officer and compliance committee

Alerts raised, closed with a legitimate reason, escalated and substantiated, by rule and period.

Break down by
Rule, Period, Department, Outcome
Delivered as
Live view; PDF for committee packs
Used for
Reporting on the program and showing where rules need tuning.

Findings and sanctions

For privacy officer, HR and compliance committee

Substantiated findings by category and the sanctions applied, with time from alert to sanction.

Break down by
Finding category, Sanction, Department, Period
Delivered as
Live view; PDF export
Used for
Showing that sanctions are applied consistently under your policy.

Protected-patient access

For privacy officer

Access to protected patients' records, the alerts raised and their outcomes.

Break down by
Protected group, Department, Outcome, Period
Delivered as
Live view; restricted to the privacy officer and designees
Used for
Close oversight of the records most likely to attract curiosity.

Monthly service report

For privacy officer and compliance leadership

Alerts triaged, escalations, feed health, rule changes and decisions due in the month.

Break down by
Period, Rule, Outcome
Delivered as
PDF; reviewed in the monthly service meeting
Used for
Overseeing the service and making the decisions Moraph brings.

Quality

Closure quality review

For privacy officer

Alerts closed by Moraph that were sampled for review, the reviewer's finding and any closures reversed.

Break down by
Analyst, Rule, Closure reason, Period
Delivered as
Live view; CSV export
Used for
Checking that closures are sound and adjusting the runbook where needed.

Closure reasons by rule

For privacy officer and Moraph engineer

The legitimate reasons recorded when alerts were closed, by rule, to show where rules raise alerts that rarely lead anywhere.

Break down by
Rule, Closure reason, Department, Period
Delivered as
Live view; CSV export
Used for
Pointing rule tuning at the alerts that cost the most effort for the least value.

Compliance and audit

Rule change history

For privacy officer and auditors

Every rule and protected-patient change, the test behind it, who approved it and when it took effect.

Break down by
Rule, Change date, Approver, Change type
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that access review is governed and changes approved.

Audit trail extract

For internal audit and the privacy officer

Who did what and when for a selected alert, case or period, including views of patient and employee details.

Break down by
Record, User, Action, Date range
Delivered as
On request; CSV and PDF export
Used for
Answering audit requests and showing that the privacy team's own access is reviewable.

Exports, access and evidence

  • Reports Moraph produces are available in its service portal and can be exported to CSV, with summary and evidence reports in PDF. The monthly service report is delivered before each service meeting.
  • FairWarning's own reports remain available to your privacy team under the roles you grant; Moraph's reports add triage, feed health and change records.
  • Reports respect each viewer's role: HR sees only referred findings, protected-patient reports are limited to the privacy officer and designees, and auditors get read-only access with a scope and an end date.
  • Program reports can be produced for compliance committee and board packs, with patient and employee details removed.
  • Running and exporting a report is recorded in the audit trail, and compliance reports can be run for a past period.

Deployment

Where and how it runs

FairWarning cloud service

FairWarning operates the monitoring platform in its cloud; Moraph configures and runs it for you.

Existing deployment

Where you already own FairWarning, Moraph reviews its feeds and rules and takes over operation and triage.

With other Moraph services

Run alongside Moraph's Identity Governance, Email Security or Pharmacy Diversion Monitor.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Scoping

We agree the applications, facilities and users in scope, and review any existing FairWarning deployment. We need contacts from privacy, HR, the EHR team and integration.

Data feeds

Access log, HR and registration extracts are specified and built with your teams, and account-to-employee mapping is checked for gaps.

Rule baseline

Relationship, self-access, protected-patient and other rules are configured from a documented baseline and reviewed with your privacy officer.

Tuning period

Rules run against live activity while alerts are reviewed together, legitimate patterns are documented, and thresholds are adjusted before handover.

Runbook and roles

The triage runbook, legitimate reason codes, escalation routes, HR referral process and roles are agreed and configured.

Handover

Your investigators are trained on case work, staff communications about monitoring are prepared with you, and Moraph's analysts take over the alert queue.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not FairWarning or its owner, Imprivata. FairWarning's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
  • Licences bought through Moraph remain subject to FairWarning's licence terms.
  • Monitoring is only as complete as the access logs, HR data and patient demographics your systems provide; applications not connected are not monitored.
  • Rules and analytics flag access for review; they do not prove that access was inappropriate. Some inappropriate access will look legitimate and will not be flagged.
  • Moraph does not interview employees, contact patients, decide findings or sanctions, or determine breaches; those remain with your organization.
  • It does not prevent access in the EHR. It finds access after it happens.
  • Notification to patients, HHS, state agencies or the media remains your organization's decision and responsibility.
  • Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List the applications holding PHI and check which can supply access logs
  2. Check how well your HR data and account records let access be attributed to employees
  3. Draft the runbook: what Moraph may close, and which alerts always come to your team
  4. Walk through an alert from triage to finding, sanction and breach determination
  5. Decide who belongs in protected-patient groups and who may see their alerts
  6. Confirm how your sanctions policy will be applied and recorded

Questions

Frequently asked questions

Will Moraph decide whether our staff broke the rules?

No. Moraph triages alerts and closes those with a documented legitimate reason under your runbook. Findings, sanctions and breach determinations are made by your privacy team and HR.

Which systems can be monitored?

Your EHR's access logs, and other applications that hold PHI where FairWarning supports their logs and they are in scope. Applications not connected are not monitored.

We already own FairWarning. Can you run it?

Yes. Moraph can review your existing feeds and rules, tune them, and take over operation and alert triage.

Do we need a business associate agreement?

Yes. The service handles PHI, so Moraph signs a business associate agreement with you, and your agreement with FairWarning covers its own handling.

Can we answer a patient who asks who looked at their record?

Yes. Moraph prepares an access report for the patient's record when your privacy team asks; what is disclosed to the patient is your decision.

How is it priced?

FairWarning licences are priced under FairWarning's terms, and the managed service by the applications, users and alert triage in scope. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Patient Privacy Monitoring

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Patient Privacy Monitoring guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Patient Privacy Monitoring support guide.

Related products