Cloud Content

Moraph resells, implements and runs Box for Healthcare as the place your organization keeps unstructured content: research files, policies, committee papers and documents shared with partners. We configure Box for your folder structure, sharing rules, classification and retention, move content in from file shares, and handle administration and support. Box provides the platform under its business associate agreement with you; Moraph operates it under ours; your organization decides who may see and share what.

The problem it solves

Healthcare organizations keep large amounts of content outside the EHR: research data and papers, policy and procedure documents, committee minutes, contracts and files exchanged with partners. Much of it sits on aging file shares, in personal cloud accounts or in email attachments, where nobody can say who has access, what holds patient information, or how long it is kept. A HIPAA-capable content platform helps only when it is configured with sensible sharing rules, retention and classification, and when someone looks after it day to day.

Who it’s for

• IT and infrastructure leaders at hospitals, health systems and academic medical centers
• Research administrators and investigators who share files with outside collaborators
• Privacy and compliance officers responsible for where PHI is stored and shared
• Records managers and legal teams who set retention and legal holds
• Policy and quality teams who publish and maintain controlled documents

1. OrganizeContent is arranged in a folder structure agreed with you, with each top-level area owned by a department or project and access granted through groups from your identity provider.
2. ShareStaff share files and folders with colleagues and approved outside collaborators within the rules your privacy officer sets, and folder owners can see and revoke what has been shared.
3. GovernRetention policies and legal holds are configured in Box as your records and legal teams direct, so content is kept for as long as required and no longer.
4. Support and monitorMoraph handles requests from your service desk and folder owners, reviews security alerts and unusual activity, and meets you monthly to review the service.

HIPAA-capable storage

Box for Healthcare is offered with a business associate agreement from Box, and Moraph configures it with the settings your organization needs to store PHI.

Folder structure and ownership

Top-level areas for departments and projects, each with a named owner, and access granted through groups rather than individual invitations.

Sharing rules

Box enforces your defaults for shared links and outside collaborators, such as who may open a link and whether it expires.

Classification labels

Box Shield labels mark content such as PHI or research data and apply stricter sharing and download rules to it, where licensed.

Unusual activity alerts

Box Shield raises alerts for activity such as large downloads or suspicious sign-ins, reviewed by Moraph under your runbook, where licensed.

Retention and legal holds

Box Governance applies retention policies and legal holds that your records and legal teams decide, where licensed.

Version history and recovery

Box keeps file versions and deleted content for the periods your settings allow, and Moraph restores content on request.

Outside collaborator review

Periodic lists of outside collaborators by folder for owners to confirm or remove, so access ends when projects do.

Migration from file shares

Moraph plans and runs moves from file shares and other repositories, with your teams deciding what moves, what is archived and what is deleted.

Desktop and mobile access

Box Drive and the Box mobile apps configured with your device rules, so staff work with files without keeping uncontrolled copies.

Office editing

Documents opened and edited with Microsoft 365 or Google Workspace from Box, where your organization uses them.

Administration as a service

User, group and folder administration, access requests and restores handled by Moraph through your service desk.

Service owner (your organization)

Owns the Box service and approves configuration changes

Privacy officer (your organization)

Sets sharing and classification rules and decides on exceptions and possible breaches

Records manager (your organization)

Decides retention periods and works with legal on holds

Folder owner (your organization)

Manages access to their department or project area and invites collaborators

Moraph Box administrator

Configures Box, manages users and folders, and applies approved changes

Moraph support analyst

Handles service desk requests and reviews security alerts

Auditor (read-only)

Reviews configuration, access and activity records without changing anything

Single sign-on and provisioning

Staff sign in to Box through your identity provider (SAML), and accounts and groups are provisioned from it.

File shares and other repositories

Content moved from network file shares and other repositories during migration, with folder permissions mapped where possible.

Microsoft 365 or Google Workspace

Documents stored in Box opened and edited in the office tools your organization uses.

SIEM

Box events such as sign-ins, downloads, sharing changes and admin actions forwarded to your security information and event management system.

Device management

Box Drive and mobile apps deployed and controlled through your mobile device management tools.

Service desk

Access requests, restores and incidents flow between Moraph and your IT service management tool.

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Administration, support and folder ownership are separate roles, and Moraph's administrators do not open your content without authorization.

Business associate agreements

Moraph signs a business associate agreement with you for its administration and support, alongside your agreement with Box for the Box service.

Encryption and keys

Box encrypts content as part of its service, and Moraph staff cannot use their administrative access to reach content without your explicit, time-bound authorization.

Complete audit trail

Every configuration change, access grant, restore and authorized content access by Moraph is logged with the person and time.

Data residency

Records Moraph keeps about the service stay in the hosting region you choose: the United States, the United Kingdom or Australia. Where Box stores content follows your Box agreement.

Box cloud service

Box operates the content platform in its cloud under your Box agreement; Moraph configures and administers it for you.

Existing Box enterprise

Where you already use Box, Moraph reviews and takes over administration of your existing enterprise without moving content again.

With other Moraph services

Run alongside Moraph's Email Security, Identity Governance or Clinical Collaboration services.

Scoping

We agree the users, departments, content sources and Box add-ons in scope, and review any existing Box enterprise. We need contacts from IT, privacy, records and the departments moving first.

Agreements and identity

Business associate agreements are put in place with Box and Moraph, and Box is connected to your identity provider for sign-in and provisioning.

Configuration baseline

Enterprise settings, sharing rules, classification labels and folder structure are configured from a documented baseline and reviewed with your service owner and privacy officer.

Retention and holds

Your records manager's retention schedule is translated into Box policies, where licensed, and the process for legal holds agreed with your legal team.

Migration in waves

Content moves department by department, with your teams deciding what moves, what is archived and what is deleted, and permissions checked after each wave.

Training and handover

Folder owners are trained on sharing and access reviews, the support runbook and escalation routes are agreed, and Moraph takes over administration.

• Moraph is not Box. Box's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Box's terms, and some features described here, such as classification, threat alerts and retention, depend on the add-ons you license.
• Box is a content platform, not an electronic health record or a research data capture system. Clinical documentation stays in your EHR.
• A business associate agreement with Box is your organization's agreement with Box; Moraph's agreement covers only Moraph's administration and support.
• Sharing rules reduce the chance of content being shared wrongly; they cannot stop an authorized person from sharing data they are permitted to share.
• What is migrated, archived or deleted, and how long content is kept, are your organization's decisions.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Moraph supports your audits and research compliance reviews with evidence; it does not certify your compliance with HIPAA or 21 CFR Part 11.

• List the content sources you would move and decide what you would archive or delete instead
• Draft your sharing rules for PHI, research data and general content and review them with Moraph
• Check which Box add-ons your use of classification, alerts and retention would need
• Walk through a sharing exception from request to end date
• Review how Moraph's access to content is authorized and reported
• Confirm who on your side owns each top-level area and approves configuration changes