Lesson plan

Protecting patient data with Moraph managed platforms

Run HIPAA-focused identity, sign-on, privacy monitoring, email, messaging, collaboration, network access and medical device services with Moraph, and know which decisions and BAA responsibilities stay with your organization.

Back to the course

Product: Identity Governance
Level: Practitioner
For: Administrators, Implementation partners
Total time: 2 hr 33 min
Lessons: 13 in 3 modules
Assessments: 4

Course objectives

Explain how responsibility is split between the platform vendor, Moraph and your organization for each healthcare managed platform
Identify which business associate agreement covers which party, and confirm coverage before PHI flows
Apply the HIPAA minimum necessary standard through role models, certifications and sensitive record entitlements
Set sign-on, timeout and network access policies that protect patient data without interrupting care
Use privacy monitoring, email security and medical device findings as evidence while keeping findings, sanctions and breach decisions with your staff
Configure secure messaging and Teams for clinical use with retention, recording and guest settings your privacy officer approves

Before the course

You have completed Working with Moraph managed platforms, or already raise and approve change requests with Moraph
You have a role in administering or implementing at least one of these services at a healthcare organization
You know who your organization's HIPAA privacy officer and security officer are

Module 1: Shared responsibility for patient data (30 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Three parties, one service	Reading 10 min	Describe what the platform vendor, Moraph and your organization each do in a healthcare managed platform Recognize the decisions Moraph never makes on your behalf Use the responsibilities table to route a question to the right owner	Reading
Business associate agreements across the services	Reading 12 min	Explain why a business associate agreement is needed before PHI flows through a managed service Identify whether Moraph's agreement, the vendor's agreement or both apply to each service Run a BAA readiness check during onboarding	Reading
Module 1 knowledge check	Assessment 8 min	Check that you can route a task to the vendor, Moraph or your organization Check that you can tell which business associate agreement covers which party	5 questions · pass mark 70% · unlimited attempts

Module 2: Controlling who can reach patient data (45 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Minimum necessary access with Identity Governance	Reading 13 min	Explain how a unit and job based role model supports the HIPAA minimum necessary standard Trace joiner, mover and leaver events through SailPoint and spot where they can fail Set up sensitive record entitlements and certifications that a privacy officer can rely on	Reading
Sign-on and timeouts on shared workstations	Reading 11 min	Explain how badge tap sign-on and fast user switching support unique user identification Plan timeout and lock policies by area with the right approvals Keep application sign-on profiles working through EMR upgrades	Reading
Network access and medical device risk	Reading 13 min	Plan staged network access enforcement that does not interrupt patient care Handle an unknown or quarantined device with the right approvals Track a medical device vulnerability to a patch, a compensating control or a documented risk acceptance	Reading
Module 2 knowledge check	Assessment 8 min	Check that you can apply minimum necessary controls through identity governance Check that you can route sign-on, network access and device risk decisions to the right approver	5 questions · pass mark 70% · unlimited attempts

Module 3: Protecting patient information in use (1 hr 18 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Privacy monitoring and investigations	Reading 12 min	Describe how FairWarning alerts move from detection to Moraph triage to your investigators Keep data feeds and the triage runbook healthy enough to trust Separate what Moraph documents from what your privacy team and HR decide	Reading
Email security and breach assessment evidence	Reading 11 min	Set up protected people, lookalike domain rules and the triage runbook with the right approvals Follow a reported phishing message through triage, removal and escalation Assemble the evidence your privacy officer needs for a breach risk assessment	Reading
Secure messaging and Teams for clinical use	Reading 12 min	Decide which secure messaging and Teams settings need privacy officer approval Plan retention, recording and guest access settings for clinical use Explain why neither TigerConnect nor Teams is the medical record	Reading
Practical: map a privacy incident across services	Practical exercise 15 min	Map an incident that crosses several managed platforms to the right owners Separate the evidence Moraph provides from the decisions your organization makes Identify the root-cause fix and who approves it	Practical exercise with a checklist
Module 3 knowledge check	Assessment 8 min	Check that you can separate Moraph's triage and evidence from your organization's decisions Check that you can route messaging and collaboration settings to the right approver	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show that you can apply shared responsibility and BAA coverage across Moraph's healthcare managed platforms Show that you can route access, policy, risk and breach decisions to the right owner	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.