Enterprise Mobility

Moraph resells, implements and runs Jamf or Workspace ONE to manage the shared iPads, iPhones and Android handhelds your clinicians carry on the unit, including devices used with Epic Rover and similar mobile apps. The platform enrolls each device, applies your configuration, and erases or resets shared devices between shifts so the next clinician starts clean. Moraph's service team watches the fleet every day, works the exceptions, and gives your IT and security teams the evidence they need for HIPAA.

The problem it solves

Shared mobile devices on clinical units pass from one clinician to the next at every shift change. When a device is not reset, the next user can open the last person's session, cached messages or photos, and patient information sits on a device that may leave the building in a pocket. Most hospital IT teams manage these devices alongside laptops and desktops, with little time to check that every handheld was wiped, charged, updated and returned. Lost devices are reported late, and when an auditor asks how shared devices are protected, the answer is a policy rather than a record.

Who it’s for

• Hospital and health system IT teams responsible for clinical mobile devices
• Nursing and unit leaders whose staff share iPads and handhelds across shifts
• Clinical informatics teams who own Epic Rover and other mobile clinical apps
• HIPAA security officers who need evidence that devices holding PHI are protected
• Ambulatory and post-acute providers running shared tablets for intake and care

1. EnrollNew and returning devices are enrolled automatically through Apple Business Manager or Android Enterprise zero-touch, so they arrive on the unit already configured and assigned.
2. Hand over between shiftsShared devices are reset between users. Depending on the device and the platform, that is an erase and automatic re-enrollment, a shared-device sign-out, or a check-in that clears the last user's session and data.
3. Keep compliantMoraph checks the fleet every day against the configuration baseline your security team approved: passcode, encryption, operating system version, approved apps and last check-in.
4. Respond to lossWhen a device is lost or stolen, Moraph puts it into lost mode or wipes it remotely on the instruction of your designated contacts, and records what happened for your privacy and security officers.

Shared-device reset

Jamf or Workspace ONE erases and re-enrolls shared devices, or clears the user session, between shifts, as configured for each device type.

Zero-touch enrollment

Devices enroll through Apple Business Manager or Android Enterprise zero-touch and receive their configuration on first start, without hand setup.

Unit and role profiles

Each unit or device role gets its own Wi-Fi, certificates, restrictions, home screen and apps, so an ICU handheld and a registration tablet are set up differently.

Single-app and kiosk modes

Devices used for one purpose, such as patient intake or a clinical app, can be locked to that app or a limited home screen.

App distribution

Clinical and business apps are pushed and updated through the platform, using Apple's volume purchasing or managed Google Play.

Daily compliance check

Moraph reviews passcode, encryption, operating system version and last check-in for every device each day and works the exceptions.

Reset exception list

Devices that did not reset or check in after a shift change are listed for the service team before the next shift starts.

Lost-device response

Lost mode, remote lock and remote wipe on instruction from your named contacts, with each action recorded.

Staged updates

Operating system and app updates are tested on a pilot group, then released unit by unit in agreed windows to avoid disrupting care.

Configuration baseline

The agreed device configuration is documented, and Moraph checks the live platform against it and reviews it with you each quarter.

Change requests

Changes to profiles, apps, restrictions and wipe rules are made only against a request approved by the owner you name, and recorded.

Service reporting

A monthly service review covers fleet size, compliance, reset exceptions, lost devices, changes and open issues.

Unit leader

Reports missing or faulty devices for their unit and confirms which devices the unit should have

Clinical informatics lead

Decides which clinical apps and home-screen layouts each device role gets

Client IT endpoint team

Owns the network, identity and purchasing that devices depend on and approves technical changes

HIPAA security officer

Approves the security baseline and wipe rules and receives lost-device records

Moraph service team

Configures, monitors and maintains the platform and works device exceptions on your behalf

Auditor (read-only)

Views the baseline, compliance and lost-device records without changing anything

Apple Business Manager

Devices bought through participating resellers are assigned for automatic enrollment, and apps are licensed through Apple's volume purchasing.

Android Enterprise

Android handhelds enroll through zero-touch or managed enrollment, and apps come from managed Google Play.

Identity provider

Administrators sign in through your identity provider, and where configured clinicians sign in to shared devices with their network credentials.

Certificate services

Device certificates for Wi-Fi and app authentication are issued from your certificate authority through the platform.

Clinical mobile apps

Epic Rover, Haiku, Limerick and other clinical apps are deployed with the managed configuration their vendors document.

IT service management

Device tickets flow between your service desk and Moraph's service team, including Moraph's IT Service Management service where you use it.

Single sign-on on devices

Shared devices can be set up to work with your badge or single sign-on service, including Moraph's Single Sign-On service built on Imprivata.

Single sign-on

Your administrators and Moraph's staff sign in to the platform through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Units see their own devices, client IT sees the fleet, and Moraph's service team works on configuration rather than on the content of devices.

Recorded device actions

Every lock, wipe, configuration change and enrollment is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. The platform vendor's own assurance reports are available from the vendor under its terms.

Business associate agreement

Where the service involves PHI on devices or in the platform, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Vendor cloud, managed by Moraph

Jamf or Workspace ONE runs in the vendor's cloud; Moraph configures and runs it for you under a managed service agreement.

Moraph-managed with your existing licenses

If you already license Jamf or Workspace ONE, Moraph can take over configuration and operations, subject to the vendor's terms.

Alongside other Moraph services

Run with Moraph's Single Sign-On, Secure Messaging or Asset Tracking services so devices, sign-on and messaging are managed together.

Current-state review

We review your devices, units, clinical apps and any existing management tool, and agree which devices are shared and how each should be reset.

Baseline design

Security, clinical informatics and client IT agree the configuration baseline for each device role, including passcode, encryption, apps, layouts and reset method.

Platform setup

The platform is connected to Apple Business Manager or Android Enterprise, your identity provider and certificate services, and profiles are built to the baseline.

Pilot unit

One or more units run on the managed configuration first, and reset behavior and clinical apps are checked with the people who use them.

Unit-by-unit rollout

Remaining units move over in an agreed order, with devices re-enrolled or migrated from your previous tool where the platform supports it.

Handover to service

Daily monitoring, change requests, lost-device procedures and the monthly service review begin, and your contacts are confirmed.

• Moraph is not Jamf or Omnissa, the vendor of Workspace ONE. The platform belongs to its vendor, and the vendor's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to the vendor's terms, and the settings available depend on what the platform and the device's operating system support.
• How a shared device is reset depends on its type and operating system. Some devices are erased and re-enrolled, others have their user session cleared; the method is agreed for each device role.
• A device that is switched off, out of Wi-Fi range or not returned cannot receive a reset or wipe until it reconnects. The exception list shows these devices; it cannot reach them.
• Location of lost devices is available only where the platform, the operating system and your policy allow it.
• Moraph does not supply, repair or replace hardware, and does not manage personally owned devices unless that is agreed in scope.
• Your organization remains responsible for its HIPAA risk analysis, device policies and breach notification decisions.
• Clinical app behavior and configuration are governed by each app's vendor; Moraph deploys apps with the settings those vendors document.

• Pick one unit and walk through what happens to a shared device from the end of one shift to the start of the next
• Ask to see a sample reset exception list and how each exception would be worked
• Review the draft configuration baseline with your security officer and clinical informatics lead
• Walk through a lost-device report from the unit to the record your security officer receives
• Check how operating system updates would be piloted and released on your units
• Confirm who at your organization approves changes and instructs wipes