Patient Privacy Monitoring

Principal workflows

• Collect: Access logs from your EHR and other clinical applications are sent to FairWarning with HR and patient demographic data, so each access can be compared with who the user is and who the patient is.
• Detect: FairWarning compares access with the rules and analytics configured for your organization and raises alerts for patterns such as staff opening the records of coworkers, family members, neighbors or patients you have marked as protected.
• Triage: Moraph analysts review each alert, look for a documented legitimate reason such as a scheduled appointment or care team assignment, and escalate the rest to your privacy team with the evidence assembled.
• Investigate and resolve: Your privacy investigators work escalated cases, interview where needed and record a finding. HR and managers decide on sanctions, and your privacy officer decides whether a breach occurred.

Who uses it

• Privacy officers and privacy teams at hospitals and health systems
• Compliance officers who report on privacy to leadership and the board
• Human resources partners who apply sanctions after a finding
• EHR and IT teams who supply access logs and user data
• Internal audit, who need evidence that access is reviewed

Reporting

• Alerts raised, closed and escalated by rule
• Open investigations by investigator and age
• Findings and sanctions by category
• Access to protected patients and outcomes
• Data feed health and gaps in monitoring
• Rule change history for auditors

Features

• EHR access monitoring: FairWarning reviews access logs from your EHR and, where connected, other clinical applications, so access is reviewed as a matter of routine rather than only after a complaint.
• Relationship rules: Rules that flag staff opening the records of coworkers, people with the same last name or address, and neighbors, configured from your HR and registration data.
• Protected patients: Patients your privacy officer names, such as public figures, board members or staff, have their access reviewed more closely.
• Self and household access: Staff opening their own record or those of their household are flagged under the policy your organization sets.
• Unusual pattern scoring: FairWarning's analytics score access that is unusual for a user's role and history; the score prompts review, and a person decides.
• Alert triage by Moraph: Moraph analysts work the alert queue, close those with a documented legitimate reason and escalate the rest with evidence.
• Case management: Escalated alerts become cases in FairWarning for your investigators, with notes, interviews, findings and attachments kept together.
• Patient access reports: A report of who opened a patient's record and when, prepared for your privacy team to use in responding to a complaint or request.
• Feed health monitoring: Moraph checks each access log and HR feed for missing or late data, so gaps in monitoring are found and fixed.
• Rule testing: Proposed rule changes are run against recent activity before they go live, and the result kept as evidence of the decision.
• Sanctions consistency: Findings and the sanctions your HR team applies are recorded by category, so your privacy officer can show that similar cases are treated alike.
• Investigator oversight: Every view of a case and of patient or employee details is logged, so access by the privacy team is itself reviewable.

Integrations

• EHR access logs: Access audit logs from your EHR, such as Epic, Oracle Health or MEDITECH, extracted on the agreed schedule in a format FairWarning accepts.
• Other clinical applications: Access logs from other systems that hold PHI, such as imaging, laboratory or pharmacy systems, where FairWarning supports them and they are in scope.
• HR system: Employee details from your HR system used to attribute access and find relationships.
• Registration and patient demographics: Patient names, addresses and protected flags from registration, used for relationship and protected-patient rules.
• Directory: Mapping of EHR and application accounts to employees, so each access is attributed to a person.
• Single sign-on: Your privacy team signs in to FairWarning and Moraph's service portal through your identity provider (SAML).
• Service desk: Feed failures and change requests flow between Moraph and your IT service management tool.

Deployment

• FairWarning cloud service: FairWarning operates the monitoring platform in its cloud; Moraph configures and runs it for you.
• Existing deployment: Where you already own FairWarning, Moraph reviews its feeds and rules and takes over operation and triage.
• With other Moraph services: Run alongside Moraph's Identity Governance, Email Security or Pharmacy Diversion Monitor.

Security and privacy

• Single sign-on: Your privacy team signs in through your identity provider, so your password and multi-factor policies apply.
• Role-based access: Triage, investigation, sanctions and configuration are separate roles, and each sees only the patient and employee details its work needs.
• Business associate agreement: Because the service handles PHI, Moraph signs a business associate agreement with you; your agreement with FairWarning covers its own handling.
• Encryption and keys: Case evidence and feed data handled by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization outside the agreed triage role.
• Complete audit trail: Every alert decision, case view, finding and configuration change is logged with the person and time, and cannot be edited.
• People decide: Analytics and scores suggest what to review; Moraph analysts and your privacy team decide, and every decision has a named person and a reason.

Limitations

• Moraph is not FairWarning or its owner, Imprivata. FairWarning's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to FairWarning's licence terms.
• Monitoring is only as complete as the access logs, HR data and patient demographics your systems provide; applications not connected are not monitored.
• Rules and analytics flag access for review; they do not prove that access was inappropriate. Some inappropriate access will look legitimate and will not be flagged.
• Moraph does not interview employees, contact patients, decide findings or sanctions, or determine breaches; those remain with your organization.
• It does not prevent access in the EHR. It finds access after it happens.
• Notification to patients, HHS, state agencies or the media remains your organization's decision and responsibility.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/patient-privacy-monitoring. Purchasing routes and company information: www.moraph.com/how-to-buy.