Skip to content

Moraph for clients

Sign in

Identity Governance

Protecting patient data with Moraph managed platforms

Run HIPAA-focused identity, sign-on, privacy monitoring, email, messaging, collaboration, network access and medical device services with Moraph, and know which decisions and BAA responsibilities stay with your organization.

Practitioner2 hr 33 min13 lessonsFor Administrators, Implementation partnersCertificate of completion

Lesson plan (printable)

About this course

Moraph resells, implements and runs a set of managed platforms for hospitals and health systems: SailPoint for identity governance, Imprivata for single sign-on, FairWarning for patient privacy monitoring, Proofpoint for email security, TigerConnect for secure messaging, Microsoft Teams for clinical collaboration and Cisco ISE for network access control, alongside Moraph's own Medical Device Cybersecurity Hub. Each one touches protected health information (PHI) in a different way, and each one splits the work between the platform vendor, Moraph and your organization.

This course is for the administrators and implementers who set these services up and keep them running. You learn who signs which business associate agreement, which settings your privacy and security officers must approve, how to use each service's records as evidence, and why the decisions that HIPAA puts on a covered entity, such as risk acceptance, sanctions and breach determinations, always stay with your staff.

What you’ll be able to do

  • Explain how responsibility is split between the platform vendor, Moraph and your organization for each healthcare managed platform
  • Identify which business associate agreement covers which party, and confirm coverage before PHI flows
  • Apply the HIPAA minimum necessary standard through role models, certifications and sensitive record entitlements
  • Set sign-on, timeout and network access policies that protect patient data without interrupting care
  • Use privacy monitoring, email security and medical device findings as evidence while keeping findings, sanctions and breach decisions with your staff
  • Configure secure messaging and Teams for clinical use with retention, recording and guest settings your privacy officer approves

Skills you’ll gain

  • HIPAA shared responsibility
  • Business associate agreements
  • Minimum necessary access
  • Privacy incident evidence
  • Clinical communication governance
  • Medical device risk

Before you start

  • You have completed Working with Moraph managed platforms, or already raise and approve change requests with Moraph
  • You have a role in administering or implementing at least one of these services at a healthcare organization
  • You know who your organization's HIPAA privacy officer and security officer are
  • Recommended first: Working with Moraph managed platforms

Syllabus

3 modules · 8 readings · 1 practical exercise · 4 assessments

  1. Module 1Shared responsibility for patient data

    1. Reading: Three parties, one serviceReading · 10 min
    2. Reading: Business associate agreements across the servicesReading · 12 min
    3. Assessment: Module 1 knowledge checkAssessment · 8 min

  2. Module 2Controlling who can reach patient data

    1. Reading: Minimum necessary access with Identity GovernanceReading · 13 min
    2. Reading: Sign-on and timeouts on shared workstationsReading · 11 min
    3. Reading: Network access and medical device riskReading · 13 min
    4. Assessment: Module 2 knowledge checkAssessment · 8 min

  3. Module 3Protecting patient information in use

    1. Reading: Privacy monitoring and investigationsReading · 12 min
    2. Reading: Email security and breach assessment evidenceReading · 11 min
    3. Reading: Secure messaging and Teams for clinical useReading · 12 min
    4. Practical exercise: Practical: map a privacy incident across servicesPractical exercise · 15 min
    5. Assessment: Module 3 knowledge checkAssessment · 8 min
    6. Assessment: Final assessmentAssessment · 20 min

What completion gives you

Complete every lesson and pass each assessment to complete the course. You then get a completion record in My learning, and a certificate of completion you can print or share, with a code anyone can check at academy.moraph.com/verify.

Completion is not certification

Course completion records and certificates of completion show that a person completed a Moraph Academy course. They are not a Moraph certification (which needs the certification exam), a professional license or an accreditation, and they do not authorize anyone to configure, operate, resell or support Moraph products on Moraph’s or anyone else’s behalf.

Course updates

  • Version 1 · · First version.