Single Sign-On

Principal workflows

• Enroll badges: Each clinician links their badge to their network account once, usually at first sign-in or at the badge office, and from then on a tap identifies them.
• Tap in, tap over: On shared workstations, a tap signs the clinician in, and a tap by the next clinician switches the session, so nobody works under someone else's sign-in.
• Maintain profiles: When an application is upgraded or added, Moraph tests and updates its sign-on profile before the change reaches clinicians.
• Prove access: Moraph keeps the configuration baseline and access records your security team needs to show unique user identification, automatic logoff and two-factor signing where it applies.

Who uses it

• Hospital IT and identity teams responsible for clinical workstation access
• CMIOs, CNIOs and clinical informatics teams who hear about sign-on friction first
• HIPAA security officers who answer for unique user identification and automatic logoff
• Pharmacy and prescriber leadership managing e-prescribing of controlled substances
• Health systems with an Imprivata deployment that needs an owner

Reporting

• Sign-on profiles failing and their status
• Staff with and without an enrolled badge
• Authentication and timeout policies with approved exceptions
• Administrator access for periodic review
• Sign-in record extracts on request for investigations
• Monthly service review

Features

• Badge tap sign-on: Imprivata OneSign signs clinicians in to workstations with a tap of their proximity badge, after a one-time badge enrollment.
• Fast user switching: On shared workstations, a tap by the next clinician locks or switches the session, so each person works under their own sign-in.
• Application sign-on profiles: Imprivata fills in credentials for the EMR and other applications so clinicians do not retype passwords in each one.
• Virtual desktop roaming: Where you use virtual desktops, the clinician's session can follow them from one workstation to the next.
• Self-service password reset: Where licensed and configured, staff reset forgotten passwords themselves after answering enrollment questions, without calling the service desk.
• Two-factor signing for EPCS: Where Imprivata Confirm ID is licensed, prescribers sign controlled-substance prescriptions with two factors, and the setup is documented for your EPCS controls.
• Timeout and lock policies: Inactivity timeouts and lock behavior are set by area, so an operating room and a registration desk can follow different rules.
• Profile testing before upgrades: Moraph tests sign-on profiles against new application versions before upgrades go live, and updates them through change requests.
• Badge enrollment management: Moraph maintains badge enrollment processes with your badge office and service desk, including lost and replaced badges.
• Configuration baseline: Policies, profiles and appliance settings are documented, checked against the live configuration and reviewed with you each quarter.
• Service monitoring: Moraph watches the health of Imprivata servers or appliances and agents, and follows up sign-on failures reported by the service desk.
• Service reporting: A monthly service review covers sign-on use, profile failures, password resets, changes, incidents and open issues.

Integrations

• Active Directory or your directory: Imprivata uses your directory for user accounts and groups, so joiners, movers and leavers follow your existing processes.
• EMR and clinical applications: Sign-on profiles fill credentials into your EMR and other applications; profiles are maintained as those applications change.
• Virtual desktops: Works with Citrix and Omnissa Horizon virtual desktop environments so sessions can follow clinicians between workstations.
• Badge readers and badge systems: Proximity badge readers at workstations read the same badges your physical access system issues.
• E-prescribing: Where Imprivata Confirm ID is licensed, two-factor signing is connected to your EHR's controlled-substance prescribing workflow.
• IT service management: Sign-on tickets flow between your service desk and Moraph's service team, including Moraph's IT Service Management service where you use it.
• Identity governance: Account status and roles from your identity governance process, including Moraph's Identity Governance service, drive who can sign in.

Deployment

• Imprivata in your data center, managed by Moraph: Imprivata servers or virtual appliances run in your environment, and Moraph configures and runs them remotely under a managed service agreement.
• Moraph-managed with your existing licenses: If you already license Imprivata, Moraph can take over configuration and operations, subject to Imprivata's terms.
• Alongside other Moraph services: Run with Moraph's Identity Governance, Enterprise Mobility or Network Access Control services so identity, devices and network access are managed together.

Security and privacy

• Multi-factor administration: Your administrators and Moraph's staff sign in to Imprivata administration with multi-factor authentication, and access is removed when people leave.
• Role-based access: The badge office manages enrollments, the service desk sees enrollment status, and Moraph's service team works on configuration rather than clinical data.
• Recorded changes and record requests: Every configuration change and every request for sign-in records is recorded with the person, time and request it served.
• Controlled privileged access: Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.
• Independent audits: Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Imprivata's own assurance documentation is available from Imprivata under its terms.
• Business associate agreement: Where the service involves PHI, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Limitations

• Moraph is not Imprivata. The software belongs to Imprivata, and Imprivata's own support commitments, roadmap and product defects apply to it.
• Licenses are subject to Imprivata's terms. Features such as two-factor signing for EPCS and self-service password reset depend on the products you license.
• Some applications cannot be profiled, or need rework after each upgrade. Moraph tests profiles before upgrades but cannot guarantee every application version will work with badge sign-on.
• Badge sign-on depends on your directory, network, workstations and readers. Moraph does not supply badge readers or workstations.
• Moraph does not issue badges or verify identity; your badge office and onboarding processes do that.
• Your organization remains responsible for HIPAA access controls, its EPCS obligations under DEA rules, and decisions about timeouts and exceptions.
• Where Imprivata runs in your data center, its availability depends on your infrastructure as well as Moraph's monitoring.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/single-sign-on. Purchasing routes and company information: www.moraph.com/how-to-buy.