Before a new patient program, a commercial launch or an AI pilot, confirm where protected health information lives in your org and who can actually reach it.
A health and life sciences health check maps where protected health information and other sensitive data sit in Salesforce, including fields, notes, emails, files and chat transcripts. We compare that map with profiles, permission sets, sharing and encryption settings, and check whether field history and audit tracking cover what your compliance team expects. For life sciences companies, we also review healthcare professional data, interaction logging and how medical and commercial teams are kept apart. The report ranks findings by patient and regulatory risk, followed by data quality and technical debt that slow down clinical, commercial or service teams.
Health data spreads in ways that configuration reviews often miss. A field built for appointment preferences becomes a place to type diagnoses, and an email-to-case inbox quietly stores lab results as attachments. Providers, payers, device makers and pharmaceutical companies each carry different obligations, and many organizations operate under more than one. Life sciences teams also need clear separation between promotional and medical activity, and reliable records of interactions with prescribers. Because a single misconfigured report or portal page can expose patient information, the review tests actual visibility with sample users instead of relying only on how permissions look on paper.
We scan object and field metadata, descriptions and a sample of free-text fields to find where health information is stored, including places nobody intended. Files, emails and chat transcripts attached to cases are included. Each location is labeled by sensitivity, with a note on whether it is encrypted, tracked and restricted, so your privacy officer has a factual inventory rather than a set of assumptions.
We log in as sample users from care coordination, billing, sales, medical affairs and support, then document what each can see and export. Login history, setup audit logs and field tracking are checked to confirm that access to sensitive records can be reconstructed after the fact. Gaps are written up as specific settings to change rather than general advice about tightening access.
For device, diagnostics and pharmaceutical organizations, we examine how prescribers, facilities and affiliations are stored, how often reference data is refreshed and how many duplicate practitioner records exist. We also check that interaction records capture the details your transparency and spend reporting depends on, and whether sample, event and meal logging follows your internal policies consistently across field teams and regions.
Patient support programs, intake forms and portals often combine Experience Cloud, Service Cloud and marketing tools. We review guest user access, consent capture, identity verification steps and how patient messages route internally. Any path by which an unauthenticated visitor or the wrong patient could reach another person's record is ranked as the highest priority finding in the report. Consent withdrawal handling is checked too.
Before any access is granted, we confirm that the appropriate business associate or confidentiality agreement is in place. The review then starts with your privacy officer and Salesforce owner, followed by leads from each team that handles patient or practitioner data. We work read-only and avoid opening individual patient records wherever metadata and aggregate checks will do. Findings involving protected information go first to compliance, who decide how and when the full report is shared with IT, operations and commercial leadership.
We check what clinical data crosses into Salesforce, whether only the minimum necessary is synced and whether error logs themselves contain patient details that should be restricted.
We review how practitioner and facility data is loaded and refreshed, how identifiers are matched and whether stale records are retired or left in circulation.
We confirm how calls, texts and chats are logged, whether transcripts containing health information are stored securely and how long they are retained.
If Salesforce stores protected health information, the org and any connected tools need appropriate agreements and safeguards. The review documents what is in scope and what controls exist, so compliance and counsel can decide whether HIPAA obligations are met. It is an input to that judgment, not legal advice.
Life sciences companies generally need to show that sales and marketing staff cannot see medical inquiries, adverse event details or patient data they are not entitled to. Check record types, sharing and reports together, since separation often fails through a single broad report rather than a permission setting.
Summaries, drafted replies and search powered by AI respect permissions, but they also make hidden data easier to find. Before a pilot, test agents with low-privilege users against records containing health details, and confirm that prompts and responses are logged in a way your policies allow.
Client names are anonymized.
We design the review to avoid it wherever possible. Most checks run against metadata, permission settings and aggregate counts. Where we need to confirm that a field contains health information, we sample under an agreement your compliance team approves and record only the finding, not the content. If your policies require it, a member of your staff can run specific checks while we observe.
It depends on what your teams collect. Device companies often gather patient details through service cases, product complaints, reimbursement support or clinical case coverage. Even if HIPAA does not apply to a given process, patient information still needs protection under other laws and your own policies. The review shows where such data exists so your counsel can determine which obligations actually apply.
Service teams sometimes receive reports of adverse events or product complaints through ordinary cases. We check whether keywords or case categories trigger a handoff to your safety or quality team, whether the required details are captured and whether cases can be closed before the handoff happens. Weak intake routing here is a regulatory risk, not just an efficiency issue.
Not always, but it is frequently worth evaluating. Shield adds platform encryption, event monitoring and extended field history, which help demonstrate control over sensitive data. The review identifies whether your current risk profile and audit needs call for those capabilities, and whether fields you would encrypt are used in ways, such as filters or formulas, that would need redesign first.
One onshore team with 150 Salesforce certifications, a Salesforce Consulting Partner since 2017.
A monthly brief for the people who own Salesforce, AI and revenue technology
What changed in Salesforce and AI this month, and what to do about it.
One email a month. Written by the consultants who deliver the work, not by a marketing team, for the leaders who make the technology decisions.
Consultant analysis, not vendor recaps. One click to leave.