Identity Governance

Moraph resells, implements and runs SailPoint identity governance for hospitals and health systems. We build role models from your HR and scheduling data so that a nurse's access to the EHR and other clinical systems follows their unit and job, changes when they transfer, and ends when they leave, supporting the HIPAA minimum necessary standard. SailPoint runs the platform; Moraph configures and operates it, runs the access reviews with your managers, and your organization decides who should have access.

The problem it solves

In most hospitals, access to the EHR and other clinical systems is granted by ticket and copied from a colleague, so people collect access as they float, transfer and change jobs. Unit-based restrictions in the EHR depend on someone assigning the right security template, and leavers keep accounts in systems that are not connected to HR. Access reviews are spreadsheets sent to managers who approve everything, and when a privacy officer or auditor asks why someone could see a record, the answer is hard to reconstruct.

Who it’s for

• Hospitals and health systems with an EHR and many connected clinical and business applications
• CISOs, identity and access management teams and IT security leaders
• Privacy officers responsible for the minimum necessary standard
• Nurse managers and department leaders who approve and review their staff's access
• Internal audit and compliance teams who test access controls

1. JoinersWhen HR records a new hire, SailPoint creates the identity and, using the role model Moraph builds with you, provisions birthright access and the role-based access for the person's job and unit.
2. MoversWhen a nurse transfers wards or changes job, the role model recalculates their access: new unit access is granted and the old unit's access is removed, rather than added on top.
3. LeaversWhen HR records a termination, SailPoint disables accounts in connected applications, and Moraph tracks manual removals in applications that are not connected until each one is confirmed.
4. Request and reviewStaff request extra access through SailPoint with approvals by their manager and the application owner. Moraph runs periodic access certifications so managers confirm or revoke what their staff hold.

Unit and job based roles

SailPoint assigns access from roles built on job code, department and unit, so a nurse on one ward receives that ward's EHR access rather than a copy of a colleague's.

Automated joiner, mover and leaver

SailPoint grants, changes and removes access in connected applications from changes in your HR system of record.

EHR security alignment

Moraph maps your EHR's security classes, templates and department assignments to roles, so SailPoint keeps them in line with each person's current job.

Access requests

Staff request access outside their role in SailPoint, with manager and application owner approval and the reason recorded.

Access certifications

SailPoint certification campaigns ask managers and application owners to confirm or revoke access, with out-of-role items highlighted.

Separation-of-duties policies

SailPoint checks for combinations of access your policy forbids, such as approving and processing the same transaction, and flags violations for decision.

Contractor and affiliate identities

Travelers, students, agency staff and affiliated physicians managed with sponsors and end dates, so access expires when the engagement does.

Disconnected application tracking

Applications that cannot be connected get manual provisioning and removal tasks that Moraph tracks to completion.

Sensitive record access

Access to restricted areas such as behavioral health or substance use disorder records handled as separate, approved entitlements with stricter review.

Role mining

Moraph analyzes current access with SailPoint's role tools to propose roles that match how people actually work, for your teams to approve.

Access history

SailPoint records who had which access, when, and who approved it, so privacy and audit questions can be answered from the record.

Service reviews

Monthly service reviews with your identity lead covering provisioning results, open exceptions, certification progress and changes.

Identity governance lead

Owns the service at your organization, approves the role model and policies, and takes escalations

Privacy officer

Defines minimum necessary requirements and approves access to sensitive records

Manager or nurse manager

Approves requests and certifies the access their staff hold

Application owner

Approves access to their application and certifies its entitlements

Moraph service engineer

Configures and operates SailPoint, carries out approved changes and follows up exceptions

Auditor (read-only)

Reviews access records, certifications and the change history without changing them

HR system of record

Hires, transfers, job changes and terminations drive the identity lifecycle in SailPoint.

EHR

SailPoint provisions EHR user accounts and the security classes, templates and departments mapped to each role, where the EHR supports it.

Directory and single sign-on

Active Directory or Entra ID accounts and groups managed by SailPoint, which in turn control access through your single sign-on.

Contractor and credentialing sources

Agency, traveler, student and affiliated physician records, including Moraph's Credentialing & Privileging Portal, so access follows privileges and end dates.

Clinical and business applications

Connected applications such as PACS, laboratory, pharmacy and ERP systems, through SailPoint connectors where available.

IT service management

Manual provisioning and removal tasks for disconnected applications raised as tickets in your service desk tool.

Privacy monitoring

Role and unit data shared with your patient privacy monitoring tool, so access to records outside a person's role can be investigated.

Named Moraph administrators

Moraph staff work in your SailPoint tenant with individual accounts, the least administrative rights the service needs and multi-factor authentication; there are no shared accounts.

Business associate agreement

Where the service involves protected health information, Moraph signs a business associate agreement before work begins.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Complete audit trail

SailPoint records requests, approvals, certifications and provisioning, and Moraph's change record links each change to its request and approval.

People decide

Moraph's tooling may suggest roles or flag unusual access, but your managers, application owners and privacy officer make every access decision.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service; service records are encrypted with keys staff cannot use without explicit, time-bound authorization. SailPoint's own attestations cover the platform.

Licences through Moraph

Moraph resells the SailPoint subscription and runs it as one service, subject to SailPoint's terms.

Your existing SailPoint

If you already license SailPoint, Moraph reviews the current configuration against a new baseline and takes over its operation.

Co-managed

Your team keeps some work, such as application onboarding or first-line support, and Moraph runs the rest; the split is written into the responsibilities for the service.

Discovery

We review your HR data, applications, EHR security model and current provisioning process, and agree which applications are connected first.

Identity data

HR, scheduling and contractor sources are connected and mapped, and data quality issues such as missing units or managers are listed for your HR team to fix.

Role model

Roles by job and unit are proposed from your current access and your minimum necessary requirements, and approved by your identity governance lead and privacy officer.

Application onboarding

Applications are connected in agreed waves, starting with the directory and EHR, with each application owner signing off before go-live.

First certification

A first access certification cleans up existing access before automated roles take over, with managers trained on how to review.

Transition to service

The responsibilities, approvers, emergency procedures and service review schedule are confirmed, and Moraph takes over day-to-day operation.

• Moraph is not SailPoint. SailPoint operates the platform, and SailPoint's own service commitments, roadmap, maintenance and outages apply.
• SailPoint licences are subject to SailPoint's terms. Some capabilities, and the number of identities and connectors, depend on the modules licensed.
• SailPoint governs which accounts, roles and entitlements a person holds. Which patients a user can see on a ward is enforced by the EHR's own security settings, which SailPoint assigns but does not replace.
• Automated changes only reach applications that can be connected. Others need manual tasks, which Moraph tracks but application owners complete.
• The role model is only as accurate as your HR data. Missing or wrong job codes, units and managers lead to wrong access until they are fixed at the source.
• This service is not patient privacy monitoring. It does not review which records a user actually opened.
• Moraph configures controls to support HIPAA requirements, but your organization owns the risk analysis and decides whether the controls are adequate. Moraph does not certify compliance.
• Moraph does not make access decisions or accept risk on your behalf; exceptions and violations need a decision from your named approver.

• Pick one nursing unit and compare the access its staff hold today with the role Moraph would propose
• Follow a transfer between two units and confirm old access is removed, not just new access added
• Check how a leaver is handled in an application that cannot be connected
• Review a sample certification as a nurse manager and judge whether it is clear enough to decide
• Read the responsibilities table and confirm the split with SailPoint and Moraph suits your team
• Ask how emergency access changes are approved and reviewed