An outside review for Midlands Salesforce orgs that hold member, borrower or patient data, identifying security gaps, technical debt and the fixes that should come first.
Because Columbia's employer base includes health and life insurers, agricultural lenders and hospital systems, many local orgs hold sensitive data, and a health check starts there. The work begins with who can view, change and export member and patient records, including through integration accounts, and then turns to data quality, automation, code, packages and adoption. Every finding carries a risk score, an effort estimate and a suggested remedy. The report also shows what needs attention before an Agentforce pilot, since AI features inherit whatever access and data problems already exist.
Carriers and lenders here answer to regulators and business partners who ask how customer data is protected. The review traces every route to member and borrower records, including list views, reports, APIs and email, and checks that encryption, event monitoring and retention settings match written policy. Findings reference the exact setting involved, so compliance officers and admins can agree on corrective actions and document them ahead of the next examination.
Hospital systems using Salesforce for referrals and physician relations sometimes store more clinical detail than intended in notes and attachments. A health check scans for that, reviews field-level security and report sharing, and checks whether guest users or portals expose records to people outside the organization. It also looks at how long patient-related data is kept, since retention settings often go unexamined for years after the original launch team moves on.
For medical suppliers and life sciences firms, the health check focuses on whether complaint and adverse event intake is complete and traceable: required fields, audit history on key records, and alerts when cases age without action. We also check that customer contract data is consistent, since pricing and reorder reports depend on it, and flag customizations that lack tests, since those would slow any change that quality staff must validate before release.
Member, broker and customer portals widen who can reach Salesforce. Check guest user permissions, sharing sets and self-registration settings as part of the review, since misconfigured public access is among the more serious exposures an outside review can uncover in regulated orgs.
Much of an org's risk sits in its connections to policy, loan and ERP systems. Review each integration user's permissions, credential storage, error handling and logging, and confirm every connection still has an owner, since unmanaged integrations can fail or leak data unnoticed.
Set a date a few months after the health check to confirm fixes landed and nothing new has drifted. A short follow-up keeps findings from stalling, and it shows auditors and leadership that the organization acts on what reviews uncover.
How our salesforce health check works →
Client names are anonymized, and these projects are not specific to Columbia.
You get a written findings document in which every item names the setting, component or process involved, its risk and effort, and the fix we suggest. We walk admins through the technical detail and give leadership a shorter summary of the top risks and the recommended sequence. Quick wins are listed separately so your team can start fixing issues the same week.
The review is evidence for your preparation rather than a formal attestation. The review documents how access, logging, retention and change control are actually configured, which helps compliance staff answer examiner questions accurately. Gaps found in advance can be corrected and documented before the exam, rather than discovered during it, and the report becomes part of your evidence file.
Very little, because we spend nearly all of the review inside the org's setup screens and metadata, not in meetings with your staff. We ask for short interviews with admins, a few users and business owners, scheduled in Eastern business hours to suit your team. The findings walkthrough can be held in person in Columbia if several departments need to agree on priorities together in one room.
One onshore team with 150 Salesforce certifications, a Salesforce Consulting Partner since 2017.
A monthly brief for the people who own Salesforce, AI and revenue technology
What changed in Salesforce and AI this month, and what to do about it.
One email a month. Written by the consultants who deliver the work, not by a marketing team, for the leaders who make the technology decisions.
Consultant analysis, not vendor recaps. One click to leave.