Requirements ยท Healthcare
HIPAA
Health Insurance Portability and Accountability Act: Privacy, Security, Breach Notification and transaction rules. 41 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a US federal law. Its Privacy, Security and Breach Notification Rules, at 45 CFR Parts 160 and 164, govern how covered entities (health plans, health care clearinghouses and health care providers that conduct certain transactions electronically) and their business associates use, disclose and protect protected health information. The rules are issued by the US Department of Health and Human Services (HHS), and its Office for Civil Rights enforces them.
Source: 45 CFR Part 164 (eCFR). HIPAA in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Moraph’s Trust Center lists “HIPAA (HITRUST CSF)” among the frameworks its controls are mapped to: “BAA-backed environments for protected health information, with controls mapped to the HITRUST CSF.” It also states: “Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.”
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- HIPAA Security Rule (45 CFR Part 164, Subpart C) 21 products
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E) 7 products
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164) 7 products
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414) 6 products
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E) 6 products
- HIPAA Breach Notification Rule (45 CFR 164.400-414) 5 products
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E) 3 products
- HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d)) 2 products
- HIPAA Administrative Simplification, transactions and code sets (45 CFR Part 162) 1 product
- HIPAA Privacy Rule (45 CFR Part 164) for patient details in procedure logs 1 product
- HIPAA Privacy Rule authorizations for research (45 CFR 164.508 and 164.512(i)) 1 product
- HIPAA Privacy Rule disclosures for public health activities (45 CFR 164.512(b)) 1 product
- HIPAA Privacy Rule policies and documentation (45 CFR 164.530(i) and (j)) 1 product
- HIPAA Privacy Rule research provisions (45 CFR 164.508 and 164.512(i)) 1 product
- HIPAA Privacy Rule safeguards (45 CFR 164.530(c)) 1 product
- HIPAA Privacy Rule workforce training (45 CFR 164.530(b)) 1 product
- HIPAA Privacy and Security Rules 1 product
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164), where covered entities participate 1 product
- HIPAA Security Rule (45 CFR Part 164, Subpart C), including access control and person or entity authentication at 45 CFR 164.312 1 product
- HIPAA Security Rule (45 CFR Part 164, Subpart C), including transmission security at 45 CFR 164.312(e) 1 product
- HIPAA Security Rule access control and risk management (45 CFR 164.308 and 164.312) 1 product
- HIPAA Security Rule access controls and audit controls (45 CFR 164.312(a) and (b)) 1 product
- HIPAA Security Rule information system activity review (45 CFR 164.308(a)(1)(ii)(D)) and audit controls (45 CFR 164.312(b)) 1 product
- HIPAA Security Rule policies and documentation (45 CFR 164.316) 1 product
- HIPAA Security Rule security awareness and training (45 CFR 164.308(a)(5)) 1 product
- HIPAA Security Rule workforce security and information access management (45 CFR 164.308(a)(3) and (a)(4)) 1 product
- HIPAA privacy and security rules 1 product
- HIPAA sanctions requirements (45 CFR 164.530(e) and 164.308(a)(1)(ii)(C)) 1 product
- HIPAA transaction and code set standards (45 CFR Part 162) 1 product
- HIPAA transaction standards (X12 270/271 and 278) 1 product
For what it requires of your organization, read the rule itself or ask your counsel. HIPAA in the glossary.
Products
The 41 products that support it
Battlefield Medical Record (Tactical EHR)
Combat medics operate in chaotic, high-stress environments. This lightweight, voice-enabled medical record system captures injury data at the "Point of Injury." It travels with the casualty and syncs with the broader military health system when a permitted connection is available, supporting continuity of care from the battlefield to the hospital; medics confirm every entry and clinical decisions remain with medical personnel.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Housing & Homelessness HMIS Wrapper
Addressing homelessness requires coordination across multiple agencies while strictly protecting client privacy. This solution is a wrapper for Homeless Management Information Systems (HMIS), designed around HUD's HMIS data and privacy standards, that lets shelters, social services and police partners coordinate care for unhoused people under the consent each client has given. Police partners can refer but cannot see client records, and what may be shared remains the Continuum of Care's decision.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164), where covered entities participate
Ambulance Run Data Sync
Ingests ePCR data from incoming ambulances to pre-populate ER trauma screens before arrival.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Antibiotic Stewardship Tracker
Tracks prescribing patterns against culture results to support CMS (42 CFR 482.42) and Joint Commission stewardship requirements. Prescribing decisions remain with clinicians.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Asset Tracking
RFID/RTLS tracking of wheelchairs, pumps, and expensive mobile equipment.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
Blood Bank Inventory & Safety
Tracking crossmatch activity, transfusion reactions, and cold-chain records for blood products alongside your FDA-cleared blood bank system, which still decides compatibility and release.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Clinical Collaboration
Provisioning Microsoft Teams under business associate agreements for secure video consults and care team chat. Privacy policy decisions and HIPAA compliance remain your organization's.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400-414)
Clinical Trial Patient Recruitment App
Patient-facing mobile app for eConsent, retention, and adverse event reporting in trials.
Lists:
- HIPAA Privacy Rule authorizations for research (45 CFR 164.508 and 164.512(i))
Cloud Contact Center
Managing patient scheduling lines and nurse triage advice calls.
Lists:
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Cloud Content
Box storage for unstructured data (research papers, policy docs) under a business associate agreement, configured to support HIPAA safeguards. Sharing and retention decisions remain yours.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400-414)
Cloud Fax
Digitizing the fax intake, routing documents directly to EMR inboxes (interoperability gap filler).
Lists:
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C), including transmission security at 45 CFR 164.312(e)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Credentialing & Privileging Portal
Automated crawler for medical boards/OIG to verify doctor credentials, reducing "Time-to-Bill" for new hires.
Lists:
- HIPAA privacy and security rules
Email Security
Advanced defense against "Whaling" attacks targeting hospital CFOs and patient data phishing.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400-414)
Enterprise Mobility
Managing the fleet of shared iPads/Rovers, with devices erased or reset between shifts. Offline or unreturned devices are reset when they reconnect.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Grant & Site Payment Manager
Automates financial reconciliation for research sites based on patient milestones.
Lists:
- HIPAA Privacy Rule research provisions (45 CFR 164.508 and 164.512(i))
Home Health Logistics Planner
Route optimization and Electronic Visit Verification (EVV) for visiting nurses.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Hospital Command Center Dashboard
Real-time visibility into bed capacity, ED wait times, and discharge bottlenecks to optimize patient flow.
Lists:
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Identity Governance
Role-Based Access Control (RBAC) tying nurses' access to their unit and job, supporting HIPAA Minimum Necessary. Patient-level limits are enforced in the EHR; access decisions remain yours.
Lists:
- HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))
- HIPAA Security Rule workforce security and information access management (45 CFR 164.308(a)(3) and (a)(4))
- HIPAA Security Rule access controls and audit controls (45 CFR 164.312(a) and (b))
Infection Control & Contact Tracing
Maps patient/staff movement within the facility to identify exposure risks during outbreaks.
Lists:
- HIPAA Privacy Rule disclosures for public health activities (45 CFR 164.512(b))
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Integration Engine
Managing the HL7/FHIR message flows between disparate clinical systems.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA transaction and code set standards (45 CFR Part 162)
IT Service Management
Specialized workflows for Clinical Engineering (e.g., "MRI in Room 4 is down").
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Learning Management
Delivering and tracking mandatory compliance training (OSHA, Bloodborne Pathogens).
Lists:
- HIPAA Privacy Rule workforce training (45 CFR 164.530(b))
- HIPAA Security Rule security awareness and training (45 CFR 164.308(a)(5))
Medical Device Cybersecurity Hub
Inventory of IoMT (Internet of Medical Things) devices, tracking patch status and vulnerabilities.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Network Access Control
Quarantining unknown medical devices that plug into hospital wall jacks.
Lists:
- HIPAA Security Rule access control and risk management (45 CFR 164.308 and 164.312)
Patient Privacy Monitoring
AI detection of "snooping" in the EMR (e.g., employees looking up VIP/neighbor records).
Lists:
- HIPAA Security Rule information system activity review (45 CFR 164.308(a)(1)(ii)(D)) and audit controls (45 CFR 164.312(b))
- HIPAA Privacy Rule minimum necessary standard (45 CFR 164.502(b) and 164.514(d))
- HIPAA sanctions requirements (45 CFR 164.530(e) and 164.308(a)(1)(ii)(C))
- HIPAA Breach Notification Rule (45 CFR 164.400-414)
Patient Safety & Incident Reporting
"Near miss" reporting portal with root-cause analysis workflows, structured to align with AHRQ Common Formats for PSO submission. Event classification and reporting remain your organization's.
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Payer Contract Lifecycle Management
Audits actual insurance reimbursements against negotiated fee schedules to find underpayments.
Lists:
- HIPAA Administrative Simplification, transactions and code sets (45 CFR Part 162)
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Pharmacy Diversion Monitor
Analytics to detect statistical anomalies in controlled substance dispensing (Opioid Stewardship).
Lists:
- HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164)
Physician On-Call Scheduling
Rules engine managing complex shift rotations and "fairness" logic for holiday coverage.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Policy Management
Central repository for hospital policies and procedure attestation.
Lists:
- HIPAA Privacy Rule policies and documentation (45 CFR 164.530(i) and (j))
- HIPAA Security Rule policies and documentation (45 CFR 164.316)
Referral & Prior Auth Gateway
Interoperability bridge that checks insurance eligibility and auto-submits Prior Auth requests to reduce denials.
Lists:
- HIPAA transaction standards (X12 270/271 and 278)
- HIPAA Privacy and Security Rules
Remote Patient Monitoring
Managing data streams from home kits (scales, cuffs) into the care management dashboard.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Residency Program Manager
Tracks resident duty hours and procedure logs against ACGME requirements to support accreditation. ACGME submissions and compliance remain with your programs.
Lists:
- HIPAA Privacy Rule (45 CFR Part 164) for patient details in procedure logs
Secure Messaging
Encrypted smartphone apps replacing pagers for urgent clinical alerts and lab results.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400-414)
Secure Printing
"Follow-me" printing that holds patient records until the sender taps a badge at the device. Some clinical printing uses exception devices with compensating controls.
Lists:
- HIPAA Privacy Rule safeguards (45 CFR 164.530(c))
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Single Sign-On
"Tap-and-Go" badge access allowing clinicians to roam between workstations without re-typing passwords.
Lists:
- HIPAA Security Rule (45 CFR Part 164, Subpart C), including access control and person or entity authentication at 45 CFR 164.312
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Surgical Block Scheduling Optimizer
ML-driven tool to reclaim unused operating room time and predict case durations.
Lists:
- HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Tumor Board Collaboration Platform
Aggregates pathology, radiology, and notes into a single view for multidisciplinary oncology reviews.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Virtual Scribe
AI voice-to-text for clinical documentation, designed to reduce documentation burden. Clinicians review and sign every note.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
- HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
Virtual Waiting Room & Intake
Telehealth prep queue that collects co-pays and tests patient device compatibility before the visit.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Visitor Management
Screening and badging visitors/vendors at entrances for security and health checks.
Lists:
- HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E)
- HIPAA Security Rule (45 CFR Part 164, Subpart C)
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.