Clinical Collaboration

Moraph provisions Microsoft Teams for clinical use under a business associate agreement, configured for care team chat, virtual consults and the handling of protected health information. We set up the tenant controls, meeting policies, retention and guest access your privacy and security teams approve, and then run the environment as a managed service. Your clinicians use Teams; your organization keeps control of who can do what and of every policy decision.

The problem it solves

Many health systems already license Microsoft 365, and clinicians already use Teams, but often in a configuration built for office work rather than patient care. Guest access, external meetings, recording, file sharing and retention are set once by IT and rarely reviewed against HIPAA. Virtual visits run on a mix of tools, care team chats sit beside general staff chat, and when privacy asks where a recorded consult is stored or who could join a meeting with a patient, the answer takes days to assemble.

Who it’s for

• Health systems, hospitals and physician groups that license Microsoft 365
• CMIOs, CNIOs and clinical informatics teams planning virtual care
• Privacy and security officers who answer for PHI in collaboration tools
• IT teams that want Teams run to a documented baseline without adding headcount
• Ambulatory and behavioral health practices that offer video visits

1. ProvisionMoraph assesses your Microsoft 365 tenant, agrees a clinical configuration baseline with your privacy and security teams, and applies it to Teams and the services Teams depends on.
2. CollaborateCare teams work in Teams structured for clinical use: unit and service-line teams, care team chats, and channels with membership that follows your directory groups.
3. ConsultVirtual consults with patients and outside clinicians run as Teams meetings with policies for lobbies, guests, recording and transcription that your organization has approved.
4. RunMoraph operates the environment day to day: monitoring configuration and service health, handling changes and access requests, and reporting on drift and use.

Clinical configuration baseline

A documented set of Teams, meeting, guest, file and retention settings for clinical use, approved by your privacy and security leads and kept under change control.

Business associate coverage

Moraph signs a business associate agreement with you, and we confirm that the Microsoft services carrying PHI are covered by Microsoft's own BAA terms for your agreement.

Virtual visit meetings

Teams meeting templates for patient visits, with the lobby, presenter, chat and recording settings your policy sets, and browser join for patients.

Care team structure

Teams and channels by unit, service line or program, created from templates, with membership driven by your directory groups.

Guest and external access controls

Who can invite outside clinicians, which external organizations can chat with your staff, and how guest access is reviewed and expired.

Recording and transcript governance

Where recordings and transcripts are stored, who can see them, and how long they are kept, configured to your policy and documented.

Retention and holds

Retention policies for chats, channels and recordings set in Microsoft Purview to your schedule, with legal holds applied on request from your legal team.

Sensitivity labels and sharing rules

Where your licensing includes them, labels and sharing restrictions applied to clinical teams and files so PHI is not shared outside approved groups.

Conditional access and device policy

Sign-in conditions and app protection for Teams on phones and shared workstations, configured through Microsoft Entra ID and Intune where licensed.

Configuration drift monitoring

Regular comparison of live settings against the approved baseline, with every difference corrected or explained and recorded.

Change and access requests

A single route for new teams, policy changes, guest requests and exceptions, each with your approver recorded.

Service reviews

Regular reviews of use, changes, incidents, drift and open risks with your IT, privacy and clinical informatics leads.

Privacy officer

Approves the clinical baseline and any change that affects PHI, guests, recording or retention

Clinical informatics lead

Decides how care teams and virtual visits should work in Teams and represents clinicians

Client IT administrator

Owns the Microsoft 365 tenant, licensing and directory and grants Moraph the access it needs

Clinician or care team member

Uses Teams for chat, calls, files and virtual consults under the approved policies

Moraph service team

Configures, monitors and changes the Teams environment on your behalf, on approved requests

Auditor (read-only)

Reviews the baseline, change records and access reviews without changing anything

Microsoft Entra ID

Sign-in, multi-factor authentication, conditional access and the groups that drive team membership, managed in your tenant.

Microsoft Purview

Retention, holds, sensitivity labels and audit search for Teams content, configured where your licensing includes them.

Microsoft Intune

App protection and device policies for Teams on phones, tablets and shared clinical workstations, where licensed.

Electronic health record

Where your EHR vendor supports launching Teams visits from the scheduled appointment, Moraph configures the Teams side and works with your EHR team on the rest.

Microsoft Bookings and virtual appointments

Scheduling of patient virtual appointments and reminders, where your licensing includes them.

Your service desk

Requests and incidents raised by your staff can be routed to Moraph's service desk, or Moraph's records linked to your own tool.

Security monitoring

Teams and Microsoft 365 audit events can be forwarded to your security information and event management tool.

Single sign-on

Your staff sign in through Microsoft Entra ID under your multi-factor and conditional access policies, and Moraph's staff sign in to Moraph systems through Moraph's own identity provider.

Role-based access

Clinicians see the teams they belong to, and Moraph's service team works on configuration rather than content.

Controlled privileged access

Moraph's administrative roles in your tenant are granted by your IT team, used only for approved work, and keys and credentials cannot be used without explicit, time-bound authorization.

Complete audit trail

Every change Moraph makes is recorded in the service records with the request and approval behind it, and Microsoft's audit log records actions in the tenant.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Microsoft's own compliance reports for Microsoft 365 are available from Microsoft under its terms.

Data residency

Teams content stays in the Microsoft 365 data location of your tenant, and Moraph's service records are held in the United States, United Kingdom or Australia region you choose.

Your Microsoft 365 tenant, managed by Moraph

Teams runs in your organization's tenant; Moraph configures and operates it for you under a managed service agreement.

With licenses bought through Moraph

Moraph resells the Microsoft licenses you need and manages them alongside the service, subject to Microsoft's terms.

Alongside other Moraph services

Run with Moraph's Secure Messaging, Single Sign-On or Identity Governance services so clinical communication and access are managed together.

Tenant assessment

We review your Microsoft 365 tenant, licensing, current Teams settings and how clinicians use Teams today. We need administrative read access and a contact from your Microsoft 365 team.

Business associate review

We confirm BAA coverage for the Microsoft services in scope and put Moraph's own business associate agreement in place before we handle any PHI.

Clinical baseline

We draft the clinical configuration baseline with your privacy, security and clinical informatics leads, and they approve it before anything changes.

Pilot

The baseline is applied to a pilot group, such as one unit or virtual care program, and adjusted from what clinicians and privacy find.

Rollout

Settings and team templates are applied across the organization in stages you schedule around clinical operations, with communications for clinicians.

Handover to run

Service desk routes, approvers, review cycles and reporting are agreed, and the environment moves into managed service.

• Moraph is not Microsoft. Teams and Microsoft 365 belong to Microsoft, and Microsoft's own service commitments, roadmap, maintenance and outages apply to them.
• Licenses are subject to Microsoft's terms, and some controls described here, such as sensitivity labels, advanced retention or virtual appointment features, depend on the licenses you hold.
• Business associate coverage for Microsoft services comes from your agreement with Microsoft. Moraph's BAA covers Moraph's services, not Microsoft's.
• Teams is a communication tool, not your medical record. Clinical documentation, orders and results belong in your EHR.
• Moraph does not make privacy, retention or clinical policy decisions. Your organization approves them and remains responsible for HIPAA compliance.
• Patient-side experience depends on the patient's device, browser and connection, which neither Moraph nor Microsoft controls.
• State telehealth, licensure, consent and recording rules vary, and legal advice on them is not part of the service.
• Moraph does not routinely read chats, files or recordings, so the service does not detect inappropriate content unless you configure and review tools for that purpose.

• Ask for a sample clinical baseline and compare it with your current Teams settings
• Confirm which baseline controls your current Microsoft licenses support
• Walk through a change request that affects recording or guests and check who approves it
• Review how Moraph's administrative access to your tenant is granted, logged and reviewed
• Run a test virtual visit with a patient joining from a browser on a phone
• Review a sample service review pack with your privacy officer