Patient Privacy Monitoring

Moraph resells, implements and runs FairWarning patient privacy monitoring for hospitals and health systems. We connect FairWarning to your EHR access logs and HR data, configure it to flag access such as staff opening the records of coworkers, family members, neighbors or well-known patients, and triage what it raises so your privacy team works the cases that need a decision. FairWarning provides the platform; Moraph operates it; your organization investigates, decides on sanctions and determines whether a breach occurred.

The problem it solves

Every day thousands of staff open patient records for legitimate reasons, which makes the few who look without a reason hard to find. Privacy teams are expected to review EHR access regularly, respond quickly when a patient or the press asks who looked at a record, and show that sanctions are applied consistently. Reviewing raw access logs by hand is not practical, and a monitoring platform is only useful if its data feeds stay healthy, its rules are tuned to your organization and someone works its alerts every day.

Who it’s for

• Privacy officers and privacy teams at hospitals and health systems
• Compliance officers who report on privacy to leadership and the board
• Human resources partners who apply sanctions after a finding
• EHR and IT teams who supply access logs and user data
• Internal audit, who need evidence that access is reviewed

1. CollectAccess logs from your EHR and other clinical applications are sent to FairWarning with HR and patient demographic data, so each access can be compared with who the user is and who the patient is.
2. DetectFairWarning compares access with the rules and analytics configured for your organization and raises alerts for patterns such as staff opening the records of coworkers, family members, neighbors or patients you have marked as protected.
3. TriageMoraph analysts review each alert, look for a documented legitimate reason such as a scheduled appointment or care team assignment, and escalate the rest to your privacy team with the evidence assembled.
4. Investigate and resolveYour privacy investigators work escalated cases, interview where needed and record a finding. HR and managers decide on sanctions, and your privacy officer decides whether a breach occurred.

EHR access monitoring

FairWarning reviews access logs from your EHR and, where connected, other clinical applications, so access is reviewed as a matter of routine rather than only after a complaint.

Relationship rules

Rules that flag staff opening the records of coworkers, people with the same last name or address, and neighbors, configured from your HR and registration data.

Protected patients

Patients your privacy officer names, such as public figures, board members or staff, have their access reviewed more closely.

Self and household access

Staff opening their own record or those of their household are flagged under the policy your organization sets.

Unusual pattern scoring

FairWarning's analytics score access that is unusual for a user's role and history; the score prompts review, and a person decides.

Alert triage by Moraph

Moraph analysts work the alert queue, close those with a documented legitimate reason and escalate the rest with evidence.

Case management

Escalated alerts become cases in FairWarning for your investigators, with notes, interviews, findings and attachments kept together.

Patient access reports

A report of who opened a patient's record and when, prepared for your privacy team to use in responding to a complaint or request.

Feed health monitoring

Moraph checks each access log and HR feed for missing or late data, so gaps in monitoring are found and fixed.

Rule testing

Proposed rule changes are run against recent activity before they go live, and the result kept as evidence of the decision.

Sanctions consistency

Findings and the sanctions your HR team applies are recorded by category, so your privacy officer can show that similar cases are treated alike.

Investigator oversight

Every view of a case and of patient or employee details is logged, so access by the privacy team is itself reviewable.

Privacy officer (your organization)

Owns the monitoring program, approves rules and decides findings and breaches

Privacy investigator (your organization)

Investigates escalated cases and records findings

HR partner (your organization)

Decides and records sanctions after a finding, with the employee's manager

EHR and data administrator (your organization)

Provides access log, HR and registration extracts and fixes source problems

Moraph privacy analyst

Triages alerts, closes those with a legitimate reason and escalates the rest

Moraph platform engineer

Configures FairWarning rules and data feeds and applies approved changes

Auditor (read-only)

Reviews rules, cases and evidence without changing anything

EHR access logs

Access audit logs from your EHR, such as Epic, Oracle Health or MEDITECH, extracted on the agreed schedule in a format FairWarning accepts.

Other clinical applications

Access logs from other systems that hold PHI, such as imaging, laboratory or pharmacy systems, where FairWarning supports them and they are in scope.

HR system

Employee details from your HR system used to attribute access and find relationships.

Registration and patient demographics

Patient names, addresses and protected flags from registration, used for relationship and protected-patient rules.

Directory

Mapping of EHR and application accounts to employees, so each access is attributed to a person.

Single sign-on

Your privacy team signs in to FairWarning and Moraph's service portal through your identity provider (SAML).

Service desk

Feed failures and change requests flow between Moraph and your IT service management tool.

Single sign-on

Your privacy team signs in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Triage, investigation, sanctions and configuration are separate roles, and each sees only the patient and employee details its work needs.

Business associate agreement

Because the service handles PHI, Moraph signs a business associate agreement with you; your agreement with FairWarning covers its own handling.

Encryption and keys

Case evidence and feed data handled by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization outside the agreed triage role.

Complete audit trail

Every alert decision, case view, finding and configuration change is logged with the person and time, and cannot be edited.

People decide

Analytics and scores suggest what to review; Moraph analysts and your privacy team decide, and every decision has a named person and a reason.

FairWarning cloud service

FairWarning operates the monitoring platform in its cloud; Moraph configures and runs it for you.

Existing deployment

Where you already own FairWarning, Moraph reviews its feeds and rules and takes over operation and triage.

With other Moraph services

Run alongside Moraph's Identity Governance, Email Security or Pharmacy Diversion Monitor.

Scoping

We agree the applications, facilities and users in scope, and review any existing FairWarning deployment. We need contacts from privacy, HR, the EHR team and integration.

Data feeds

Access log, HR and registration extracts are specified and built with your teams, and account-to-employee mapping is checked for gaps.

Rule baseline

Relationship, self-access, protected-patient and other rules are configured from a documented baseline and reviewed with your privacy officer.

Tuning period

Rules run against live activity while alerts are reviewed together, legitimate patterns are documented, and thresholds are adjusted before handover.

Runbook and roles

The triage runbook, legitimate reason codes, escalation routes, HR referral process and roles are agreed and configured.

Handover

Your investigators are trained on case work, staff communications about monitoring are prepared with you, and Moraph's analysts take over the alert queue.

• Moraph is not FairWarning or its owner, Imprivata. FairWarning's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to FairWarning's licence terms.
• Monitoring is only as complete as the access logs, HR data and patient demographics your systems provide; applications not connected are not monitored.
• Rules and analytics flag access for review; they do not prove that access was inappropriate. Some inappropriate access will look legitimate and will not be flagged.
• Moraph does not interview employees, contact patients, decide findings or sanctions, or determine breaches; those remain with your organization.
• It does not prevent access in the EHR. It finds access after it happens.
• Notification to patients, HHS, state agencies or the media remains your organization's decision and responsibility.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.

• List the applications holding PHI and check which can supply access logs
• Check how well your HR data and account records let access be attributed to employees
• Draft the runbook: what Moraph may close, and which alerts always come to your team
• Walk through an alert from triage to finding, sanction and breach determination
• Decide who belongs in protected-patient groups and who may see their alerts
• Confirm how your sanctions policy will be applied and recorded