Secure Printing

Moraph resells, implements and runs PaperCut for hospitals and clinics, so print jobs are held until the person who sent them taps their badge at the device. PaperCut keeps a record of what was printed, by whom and where, and Moraph configures release rules, device exceptions and logging with your privacy officer. Moraph monitors the service, manages devices and badge readers, applies approved changes and reviews the service with you every month.

The problem it solves

In a busy hospital, documents with patient information are printed to shared printers in corridors, nurses' stations and clinics, and left in the output tray for anyone to pick up. Staff send jobs to the wrong printer, pages end up with the wrong patient's paperwork, and when a privacy complaint names a printed document there is often no clear record of who printed it or where. Print servers and device settings are maintained by whoever has time, and each site does it differently.

Who it’s for

• Privacy officers and compliance teams at hospitals, clinics and health systems
• IT teams who run print servers, devices and desktop support
• Nursing, registration and clinic leaders whose staff print patient documents
• Health information management teams
• Finance and procurement teams who manage print devices and costs

1. Print and releaseStaff print as they do today. PaperCut holds the job until they sign in at a device with their badge, so pages come out only when they are standing there, at whichever enabled device they choose.
2. ExceptionsSome printing cannot wait for a badge tap, such as wristband, label and specimen printers. These devices are listed as exceptions with a reason, an owner and a compensating control, and approved by your privacy officer.
3. InvestigateWhen a printed document is found in the wrong place or named in a complaint, the privacy officer can ask for the print record: who printed it, from which workstation, to which device and when it was released.
4. OperateMoraph monitors print servers, devices and badge readers, adds and retires devices, applies approved changes and reports on the service.

Badge release

PaperCut holds each job until the user signs in at a device with their badge, or with a PIN where your policy allows.

Print at any enabled device

A held job can be released at any device on the secure queue, so staff are not tied to the printer they chose when they printed.

Unreleased job deletion

Jobs that are never released are deleted after a period your policy sets, so forgotten documents do not wait indefinitely.

Print activity log

PaperCut records who printed, from which workstation, to which device and when, for use in privacy investigations.

Document name handling

How much of each document name is kept in the logs is configured with your privacy officer, within the options PaperCut provides.

Exception register

Label, wristband and other devices that print without release are listed with their reason, owner, compensating control and review date.

Print rules

PaperCut applies rules your teams approve, such as defaulting to double-sided or black and white, or adding a watermark to selected queues.

Scan controls

On multifunction devices, scanning can require sign-in and be limited to approved destinations, such as the user's own email or a set folder.

Badge registration

Badges are linked to user accounts from your badge system or directory, and new staff can register a badge at the device where your policy allows.

Device and server monitoring

Moraph watches print servers, devices and badge readers and acts on failures before staff are left unable to print.

Device lifecycle

New devices are added to the secure queue and retired devices are removed, under your change process, so the configuration matches what is on the floor.

Monthly service review

Changes, issues, exceptions, release activity and open actions reviewed with your privacy officer and IT lead.

Privacy officer

Owns the print policy, approves exceptions and requests print records for investigations

IT administrator

Raises change requests, handles first-line user issues and coordinates device moves

Department manager

Requests devices and exceptions for their area and makes sure staff use secure release

Moraph print engineer

Configures and maintains PaperCut, devices and badge readers under approved changes

Moraph service manager

Runs the service review, tracks requests and issues, and reports on the service

Auditor (read-only)

Views the baseline, exception register, change history and service reports without changing anything

Directory

PaperCut takes user accounts and groups from your directory, so printing follows the same identities as the rest of your systems.

Badge system

Badge numbers are linked to user accounts from your badge or access control system, by file or directory attribute, or registered at the device.

EHR and clinical printing

Print queues used by your EHR and other clinical applications are pointed at the secure queue or at approved exception devices, tested with your application team.

Multifunction devices

PaperCut's software on supported devices provides badge sign-in, job release and scan controls.

Security monitoring

PaperCut and print server logs can be forwarded to your security monitoring or log platform where you want them kept alongside other logs.

Single sign-on

Administrators and managers sign in to PaperCut's web interface through your identity provider where the deployment supports it.

Moraph service records

Requests, changes, issues, exceptions and service reviews are tracked in Moraph's service records and available to your team.

Named Moraph administrators

Moraph staff work in PaperCut with individual accounts and only the administrative rights the service needs; there are no shared accounts.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it.

Business associate agreement

Print jobs and logs can contain protected health information, so Moraph works under a business associate agreement with you.

Complete audit trail

PaperCut records print and administrator activity, and Moraph's change record links each change and each print record search to its request and approval.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. PaperCut's own commitments cover its software.

Licences through Moraph

Moraph resells PaperCut licences and runs the service as one, subject to PaperCut's terms.

Your existing PaperCut system

If you already license PaperCut, Moraph reviews the current configuration against a new baseline and takes over its operation.

Co-managed

Your IT team keeps some tasks, such as first-line support or queue deployment to workstations, and Moraph runs the rest; the split is written into the responsibilities for the service.

Discovery

We inventory devices, print servers, queues, badge readers and the applications that print patient documents, with your IT, privacy and clinical teams.

Baseline design

Release rules, unreleased job deletion, log settings, print rules and proposed exceptions are designed and approved by your privacy officer.

Build

PaperCut is installed or configured to the baseline, connected to your directory and badge data, and set up on supported devices and readers.

Clinical application testing

EHR and other clinical print queues are tested with your application team, including label and wristband printing that stays on exception devices.

Site rollout

Sites and departments move to secure release in waves, with staff communications, badge registration and floor support agreed for each wave.

Handover to operations

Change process, approvers, escalation contacts, fallback printing and reporting are agreed, and the service moves into day-to-day operation.

• Moraph is not PaperCut. PaperCut provides the software, and its own support commitments, roadmap and release schedule apply, as do any outages of services it hosts.
• PaperCut licences are subject to PaperCut's terms, and some capabilities depend on the edition licensed and the device model.
• Secure release works only on supported devices with supported badge readers. Devices that cannot support it are replaced, restricted or recorded as exceptions.
• Some clinical printing, such as wristbands, labels and specimen printing, usually cannot wait for a badge tap; it stays on exception devices with compensating controls.
• Moraph does not supply, lease or repair print devices unless agreed separately; hardware faults go to your device supplier.
• Secure release protects pages at the printer. It does not stop an authorized user from mishandling a document after collecting it.
• Moraph configures controls with reference to HIPAA safeguards, but your organization decides whether they are adequate and makes all privacy and breach notification decisions.
• Fax, mail and paper records management are outside this service.

• List your devices and badge readers and check which can support secure release
• Identify the clinical printing that cannot wait for a badge tap and how it would be handled
• Walk through a print record search from the privacy officer's request to the recorded result
• Review a sample configuration baseline and exception register
• Ask how unreleased jobs, log settings and document names are handled and who decides
• Confirm the split of responsibilities between Moraph, PaperCut, your device supplier and your IT team