Key takeaways
- Salesforce can be used with protected health information, but you need a business associate agreement that covers the services you use.
- Signing a BAA does not make you compliant. Configuration, access control and processes remain your responsibility.
- Health Cloud adds a patient-centric data model and care features. Many providers start with Sales or Service Cloud instead.
- Plan encryption, audit trails and least-privilege access from day one rather than adding them later.
Healthcare organizations use Salesforce for patient intake, referrals, call centers, care coordination, billing follow-up and marketing. Because these processes involve protected health information (PHI), the Health Insurance Portability and Accountability Act (HIPAA) shapes how Salesforce should be set up. Here is what providers need to know.
This article is general guidance, not legal advice. Work with your compliance officer and legal counsel to confirm your obligations.
Start with a business associate agreement
Under HIPAA, a cloud provider that stores or processes PHI on your behalf is a business associate. Salesforce will sign a business associate agreement (BAA) with covered entities and business associates, and that agreement lists which Salesforce services are covered. Before any PHI enters Salesforce, confirm that your BAA is in place and that every product you plan to use, including add-ons, is within its scope.
The same applies to everyone else who touches the data: integration partners, consultants with access to production, and third-party apps that process PHI should be covered by their own agreements.
A BAA is the start, not the finish
Salesforce secures the platform, but how you configure it determines whether PHI is protected. Your responsibilities include deciding who can see which records, encrypting sensitive data where appropriate, monitoring access, training users and responding to incidents.
Health Cloud or Sales and Service Cloud?
| Consideration | Health Cloud | Sales or Service Cloud |
|---|---|---|
| Data model | Patient-centric objects for care plans, providers, conditions and households | Standard accounts, contacts and cases, extended with custom objects |
| Typical use | Care coordination, patient management, provider networks | Intake, call centers, referrals, admissions and follow-up |
| Cost | Higher license cost | Lower license cost |
| Implementation | More features to configure and learn | Simpler to start, more custom design required |
Health Cloud makes sense when your processes look like its model, for example longitudinal patient records, care teams and care plans. Many behavioral health, addiction treatment and specialty practices run successfully on Sales or Service Cloud with a carefully designed custom model for admissions, insurance verification and follow-up.
Security features to plan for
- Least-privilege access: restrictive organization-wide defaults, role hierarchy and sharing rules, and permission sets granting only what each role needs.
- Field-level security: hide diagnoses, insurance details and notes from users who do not need them.
- Encryption: Salesforce encrypts data in transit, and Shield Platform Encryption adds encryption at rest for sensitive fields and files under keys you control.
- Audit and monitoring: Setup Audit Trail and field history tracking are standard. Shield Event Monitoring and Field Audit Trail extend monitoring and retention for regulated environments.
- Multi-factor authentication: required for Salesforce logins, and especially important for users with access to PHI.
- Data minimization: store only the PHI the process needs, and avoid copying it into emails, Chatter or file names.
Integrations need the same care
Healthcare Salesforce orgs connect to telephony, e-signature, insurance verification, electronic health record and billing systems. Each integration should use a dedicated user with minimal permissions, encrypted connections, logging that does not record PHI unnecessarily, and a vendor agreement that covers the data it handles.
What a well-run healthcare org looks like
In a recent rebuild for Zinnia Health, a behavioral health provider, we replaced a legacy org with a healthcare-focused architecture, migrated live operations with 99.9% uptime, and aligned access with HIPAA standards through profiles, permission sets and sharing rules. Calls, contracts, payments and insurance checks were automated, which reduced manual work without loosening control over patient data.
Frequently asked questions
Is Salesforce HIPAA compliant?
No software is HIPAA compliant on its own. Salesforce offers a business associate agreement and security features that let covered entities use it in a HIPAA-compliant way when configured and governed correctly.
Do we need Salesforce Shield for HIPAA?
HIPAA does not name specific products. Many healthcare organizations use Shield for encryption at rest and extended monitoring, but the decision should follow your risk assessment.
Can patient data be used with Salesforce AI features?
Check that the specific AI features are covered by your BAA and review Salesforce’s trust documentation before using them with PHI.
