Single Sign-On

Moraph resells, implements and runs Imprivata so clinicians can sign in to shared workstations and clinical applications by tapping their badge, instead of typing passwords at every stop. Imprivata OneSign handles badge enrollment, application sign-on profiles and fast user switching, and where licensed, Imprivata Confirm ID supports two-factor signing for e-prescribing of controlled substances. Moraph's service team maintains the profiles as applications change, watches the service, and gives your security team the access records it needs.

The problem it solves

Clinicians move between workstations all day, and each one asks for a username and password, sometimes several times for different applications. Staff share sessions or leave them open to save time, which undermines unique user identification and makes it hard to say who looked at a record. Password resets fill the service desk. Hospitals that buy badge sign-on often find that application profiles break when an EMR or other application is upgraded, and that the people who set it up have moved on.

Who it’s for

• Hospital IT and identity teams responsible for clinical workstation access
• CMIOs, CNIOs and clinical informatics teams who hear about sign-on friction first
• HIPAA security officers who answer for unique user identification and automatic logoff
• Pharmacy and prescriber leadership managing e-prescribing of controlled substances
• Health systems with an Imprivata deployment that needs an owner

1. Enroll badgesEach clinician links their badge to their network account once, usually at first sign-in or at the badge office, and from then on a tap identifies them.
2. Tap in, tap overOn shared workstations, a tap signs the clinician in, and a tap by the next clinician switches the session, so nobody works under someone else's sign-in.
3. Maintain profilesWhen an application is upgraded or added, Moraph tests and updates its sign-on profile before the change reaches clinicians.
4. Prove accessMoraph keeps the configuration baseline and access records your security team needs to show unique user identification, automatic logoff and two-factor signing where it applies.

Badge tap sign-on

Imprivata OneSign signs clinicians in to workstations with a tap of their proximity badge, after a one-time badge enrollment.

Fast user switching

On shared workstations, a tap by the next clinician locks or switches the session, so each person works under their own sign-in.

Application sign-on profiles

Imprivata fills in credentials for the EMR and other applications so clinicians do not retype passwords in each one.

Virtual desktop roaming

Where you use virtual desktops, the clinician's session can follow them from one workstation to the next.

Self-service password reset

Where licensed and configured, staff reset forgotten passwords themselves after answering enrollment questions, without calling the service desk.

Two-factor signing for EPCS

Where Imprivata Confirm ID is licensed, prescribers sign controlled-substance prescriptions with two factors, and the setup is documented for your EPCS controls.

Timeout and lock policies

Inactivity timeouts and lock behavior are set by area, so an operating room and a registration desk can follow different rules.

Profile testing before upgrades

Moraph tests sign-on profiles against new application versions before upgrades go live, and updates them through change requests.

Badge enrollment management

Moraph maintains badge enrollment processes with your badge office and service desk, including lost and replaced badges.

Configuration baseline

Policies, profiles and appliance settings are documented, checked against the live configuration and reviewed with you each quarter.

Service monitoring

Moraph watches the health of Imprivata servers or appliances and agents, and follows up sign-on failures reported by the service desk.

Service reporting

A monthly service review covers sign-on use, profile failures, password resets, changes, incidents and open issues.

Clinical informatics lead

Prioritizes applications for sign-on and reports clinician friction

Client IT identity team

Owns the directory, workstations and virtual desktops and approves technical changes

HIPAA security officer

Approves authentication and timeout policies and reviews access records

Badge office

Issues badges and enrolls or replaces them with the clinician

Moraph service team

Configures, monitors and maintains Imprivata and its profiles on your behalf

Auditor (read-only)

Views policies, change history and access records without changing anything

Active Directory or your directory

Imprivata uses your directory for user accounts and groups, so joiners, movers and leavers follow your existing processes.

EMR and clinical applications

Sign-on profiles fill credentials into your EMR and other applications; profiles are maintained as those applications change.

Virtual desktops

Works with Citrix and Omnissa Horizon virtual desktop environments so sessions can follow clinicians between workstations.

Badge readers and badge systems

Proximity badge readers at workstations read the same badges your physical access system issues.

E-prescribing

Where Imprivata Confirm ID is licensed, two-factor signing is connected to your EHR's controlled-substance prescribing workflow.

IT service management

Sign-on tickets flow between your service desk and Moraph's service team, including Moraph's IT Service Management service where you use it.

Identity governance

Account status and roles from your identity governance process, including Moraph's Identity Governance service, drive who can sign in.

Multi-factor administration

Your administrators and Moraph's staff sign in to Imprivata administration with multi-factor authentication, and access is removed when people leave.

Role-based access

The badge office manages enrollments, the service desk sees enrollment status, and Moraph's service team works on configuration rather than clinical data.

Recorded changes and record requests

Every configuration change and every request for sign-in records is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Imprivata's own assurance documentation is available from Imprivata under its terms.

Business associate agreement

Where the service involves PHI, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Imprivata in your data center, managed by Moraph

Imprivata servers or virtual appliances run in your environment, and Moraph configures and runs them remotely under a managed service agreement.

Moraph-managed with your existing licenses

If you already license Imprivata, Moraph can take over configuration and operations, subject to Imprivata's terms.

Alongside other Moraph services

Run with Moraph's Identity Governance, Enterprise Mobility or Network Access Control services so identity, devices and network access are managed together.

Current-state review

We review your workstations, virtual desktops, applications, badges and any existing Imprivata deployment, and agree which areas and applications come first.

Policy design

Your security officer, client IT and clinical informatics agree authentication, timeout and lock policies by area, and record any exceptions.

Infrastructure and agents

Imprivata servers or appliances are installed or reviewed, connected to your directory, and the agent is added to your workstation images.

Profiles

Sign-on profiles are built and tested for the applications in scope, starting with the EMR and the applications clinicians use most.

Pilot and rollout

A pilot area goes live with badge enrollment support on the floor, then remaining areas follow in an agreed order.

Handover to service

Monitoring, profile maintenance, change requests and the monthly service review begin, and your contacts are confirmed.

• Moraph is not Imprivata. The software belongs to Imprivata, and Imprivata's own support commitments, roadmap and product defects apply to it.
• Licenses are subject to Imprivata's terms. Features such as two-factor signing for EPCS and self-service password reset depend on the products you license.
• Some applications cannot be profiled, or need rework after each upgrade. Moraph tests profiles before upgrades but cannot guarantee every application version will work with badge sign-on.
• Badge sign-on depends on your directory, network, workstations and readers. Moraph does not supply badge readers or workstations.
• Moraph does not issue badges or verify identity; your badge office and onboarding processes do that.
• Your organization remains responsible for HIPAA access controls, its EPCS obligations under DEA rules, and decisions about timeouts and exceptions.
• Where Imprivata runs in your data center, its availability depends on your infrastructure as well as Moraph's monitoring.

• Pick a busy unit and walk through a clinician's sign-ins over one shift, before and after badge sign-on
• List your top applications and ask which can be profiled and what testing each upgrade needs
• Review the draft timeout and lock policies with your security officer and clinical informatics
• Walk through what happens when a badge is lost
• Ask to see how a sign-on incident would be logged, worked and closed
• Confirm who at your organization approves policy changes and requests sign-in records