Secure Printing

Principal workflows

• Print and release: Staff print as they do today. PaperCut holds the job until they sign in at a device with their badge, so pages come out only when they are standing there, at whichever enabled device they choose.
• Exceptions: Some printing cannot wait for a badge tap, such as wristband, label and specimen printers. These devices are listed as exceptions with a reason, an owner and a compensating control, and approved by your privacy officer.
• Investigate: When a printed document is found in the wrong place or named in a complaint, the privacy officer can ask for the print record: who printed it, from which workstation, to which device and when it was released.
• Operate: Moraph monitors print servers, devices and badge readers, adds and retires devices, applies approved changes and reports on the service.

Who uses it

• Privacy officers and compliance teams at hospitals, clinics and health systems
• IT teams who run print servers, devices and desktop support
• Nursing, registration and clinic leaders whose staff print patient documents
• Health information management teams
• Finance and procurement teams who manage print devices and costs

Reporting

• Secure release coverage by site
• Exceptions and their review dates
• Unreleased jobs deleted under policy
• Changes, requests and device issues
• Print record searches and who requested them
• Monthly service review summary

Features

• Badge release: PaperCut holds each job until the user signs in at a device with their badge, or with a PIN where your policy allows.
• Print at any enabled device: A held job can be released at any device on the secure queue, so staff are not tied to the printer they chose when they printed.
• Unreleased job deletion: Jobs that are never released are deleted after a period your policy sets, so forgotten documents do not wait indefinitely.
• Print activity log: PaperCut records who printed, from which workstation, to which device and when, for use in privacy investigations.
• Document name handling: How much of each document name is kept in the logs is configured with your privacy officer, within the options PaperCut provides.
• Exception register: Label, wristband and other devices that print without release are listed with their reason, owner, compensating control and review date.
• Print rules: PaperCut applies rules your teams approve, such as defaulting to double-sided or black and white, or adding a watermark to selected queues.
• Scan controls: On multifunction devices, scanning can require sign-in and be limited to approved destinations, such as the user's own email or a set folder.
• Badge registration: Badges are linked to user accounts from your badge system or directory, and new staff can register a badge at the device where your policy allows.
• Device and server monitoring: Moraph watches print servers, devices and badge readers and acts on failures before staff are left unable to print.
• Device lifecycle: New devices are added to the secure queue and retired devices are removed, under your change process, so the configuration matches what is on the floor.
• Monthly service review: Changes, issues, exceptions, release activity and open actions reviewed with your privacy officer and IT lead.

Integrations

• Directory: PaperCut takes user accounts and groups from your directory, so printing follows the same identities as the rest of your systems.
• Badge system: Badge numbers are linked to user accounts from your badge or access control system, by file or directory attribute, or registered at the device.
• EHR and clinical printing: Print queues used by your EHR and other clinical applications are pointed at the secure queue or at approved exception devices, tested with your application team.
• Multifunction devices: PaperCut's software on supported devices provides badge sign-in, job release and scan controls.
• Security monitoring: PaperCut and print server logs can be forwarded to your security monitoring or log platform where you want them kept alongside other logs.
• Single sign-on: Administrators and managers sign in to PaperCut's web interface through your identity provider where the deployment supports it.
• Moraph service records: Requests, changes, issues, exceptions and service reviews are tracked in Moraph's service records and available to your team.

Deployment

• Licences through Moraph: Moraph resells PaperCut licences and runs the service as one, subject to PaperCut's terms.
• Your existing PaperCut system: If you already license PaperCut, Moraph reviews the current configuration against a new baseline and takes over its operation.
• Co-managed: Your IT team keeps some tasks, such as first-line support or queue deployment to workstations, and Moraph runs the rest; the split is written into the responsibilities for the service.

Security and privacy

• Named Moraph administrators: Moraph staff work in PaperCut with individual accounts and only the administrative rights the service needs; there are no shared accounts.
• Role-based access: What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.
• Business associate agreement: Print jobs and logs can contain protected health information, so Moraph works under a business associate agreement with you.
• Complete audit trail: PaperCut records print and administrator activity, and Moraph's change record links each change and each print record search to its request and approval.
• Encryption and keys: Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.
• Audited company-wide: Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. PaperCut's own commitments cover its software.

Limitations

• Moraph is not PaperCut. PaperCut provides the software, and its own support commitments, roadmap and release schedule apply, as do any outages of services it hosts.
• PaperCut licences are subject to PaperCut's terms, and some capabilities depend on the edition licensed and the device model.
• Secure release works only on supported devices with supported badge readers. Devices that cannot support it are replaced, restricted or recorded as exceptions.
• Some clinical printing, such as wristbands, labels and specimen printing, usually cannot wait for a badge tap; it stays on exception devices with compensating controls.
• Moraph does not supply, lease or repair print devices unless agreed separately; hardware faults go to your device supplier.
• Secure release protects pages at the printer. It does not stop an authorized user from mishandling a document after collecting it.
• Moraph configures controls with reference to HIPAA safeguards, but your organization decides whether they are adequate and makes all privacy and breach notification decisions.
• Fax, mail and paper records management are outside this service.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/secure-printing. Purchasing routes and company information: www.moraph.com/how-to-buy.