HIPAA Checklist for Salesforce Health Cloud Integration

Salesforce Health Cloud has become the hub for patient relationships, care coordination and EHR integration. That also makes it a place where a misconfigured role or an unencrypted API call turns into a HIPAA problem.

This is the checklist we work through on Health Cloud deployments, covering user roles, Shield encryption, integration security, logging, AI workflows and retention.

Why compliance breaks during integrations

Health Cloud centralises clinical and non-clinical data, so the volume of PHI in one place grows fast. Every workflow that reads, writes or transmits PHI is a potential exposure point: telehealth, EHR sync, FHIR endpoints, predictive analytics.

The common failure modes are misconfigured API permissions, unencrypted transfers, no monitoring on bulk exports, and AI features processing raw PHI because nobody scoped the inputs.

Step 1: User roles and profiles

Misconfigured access is the single most common source of PHI exposure.

• Assign permissions strictly by job responsibility. Care coordinators, providers, billing and admins each get only the objects and fields they need
• Lock down high risk objects: CarePlan, RiskAssessment, ClinicalData, PatientCard. Remove View All and Modify All from anyone who does not genuinely need it
• Use permission sets rather than per user tweaks, so audits are readable
• Review access quarterly, not annually

Step 2: Salesforce Shield

• Platform Encryption on PHI fields, attachments and EHR identifiers. Choose deterministic or probabilistic based on whether you need to filter on the field
• Event Monitoring for logins, exports and API interactions, with alerts on abnormal behaviour
• Field Audit Trail for a historical record of changes to PHI, which is what auditors actually ask for

Step 3: Data classification

• Map every field holding sensitive data: medical record numbers, patient identifiers, care notes
• Use Salesforce data classification to automate tagging and reporting
• Apply the same labelling to custom objects. Custom objects are where PHI quietly leaks during exports

Step 4: Secure the integrations

This is where most of the real risk sits. Every external connection needs its own controls.

• OAuth 2.0, mutual TLS and least privilege permissions on every connected system
• FHIR requests scoped to the minimum necessary fields, not the whole resource because it was easier
• Encrypt every EHR to Health Cloud transfer, validate the field mapping, log the transfer
• Signed BAAs for every third party app, and permissions trimmed to what the app actually uses

EPIC integration

• TLS 1.2 or above on all API calls
• Least privilege access to EPIC data inside Health Cloud
• Audit log every read and write on clinical notes, lab results and care plans
• Confirm the BAA covers EPIC and any middleware in the path

FHIR sync

• OAuth 2.0 plus mutual TLS on the endpoints
• Minimum necessary fields in every resource request
• Alerts on abnormal API usage patterns
• Validate field mapping on the way in, so PHI does not land in an unclassified field

Legacy EHR migration

• SFTP or a secure API pipeline, never a plain file drop
• Anonymise non essential PHI before the migration where you can
• Post migration audit to confirm what landed and who can see it

Step 5: Logging and monitoring

• Comprehensive logs for views, edits and exports of PHI
• Real time alerts on bulk exports and logins from unrecognised locations
• Forward Health Cloud event logs into your SIEM rather than checking them inside Salesforce

Step 6: Retention and backup

• Define retention timelines and align them with your own policy, not just the platform default
• Automate deletion of expired PHI
• Encrypt backups, restrict access, keep them in a HIPAA ready environment
• Actually test the restore. An untested backup is not a backup

AI workflows: the part most checklists miss

Health Cloud is turning into an AI platform, and the compliance story has not caught up in most orgs.

• Map every AI driven process that touches PHI: predictive analytics, chatbots, clinical decision support
• Do not send raw PHI to models outside Health Cloud. Use anonymised or tokenised data for training and testing
• Apply Shield encryption to AI input and output fields, and role based permissions on AI dashboards
• Log AI interactions with PHI the same way you log human ones, including model changes
• Sign BAAs with AI vendors where PHI is processed, and check their breach response before you sign
• Document the models, data sources and decision logic. Patients retain the right to access and correct AI influenced data

Five mistakes that come up repeatedly

1. View All and Modify All left on a profile from the original implementation. Nobody revisits it until an audit does
2. No audit logging on integrations. The Health Cloud side is logged, the middleware is not, and the gap is where the questions land
3. Encryption enabled on standard fields only. Custom objects holding PHI get missed
4. AppExchange packages installed without a BAA and with far more permission than they use
5. AI features processing raw PHI because the pilot was scoped as a demo and never re scoped

FAQ

Is Health Cloud HIPAA compliant out of the box? No. It is HIPAA ready. Shield encryption, audit logging and role based access exist, but compliance depends entirely on how you configure them.

What is the minimum to be HIPAA ready? Shield Platform Encryption enabled, role based access configured to least privilege, Field Audit Trail on, API connections secured, and a documented risk assessment.

How do AI features affect compliance? Anonymise or tokenise inputs, restrict access to outputs through role based permissions, and log every AI interaction with PHI.

---

Originally published at ashapurasoftech.com. Ashapura Softech Inc. is a certified Salesforce, Zoho, Microsoft and Odoo implementation partner based in Irving, Texas.