DEV Community: Christopher Gainus

Salesforce Health Cloud Implementation: Real Costs and Timelines (2026)

Christopher Gainus — Thu, 06 Aug 2026 16:55:14 +0000

Salesforce Health Cloud costs between $250 and $500 per user per month in licensing alone. Add implementation, integration, and customization, and a 50-clinician deployment runs $200,000 to $600,000 over the first 18 months.

I have scaled Health Cloud from 5 users to 250 in a Medicare Advantage primary care organization. Here's what drives the cost, where the money goes, and how to avoid the mistakes that inflate it.

What you're paying for

Salesforce licenses: Health Cloud is an add-on to Sales Cloud or Service Cloud. You need the base license plus the Health Cloud add-on. Budget $250-$500/user/month depending on your Salesforce edition and negotiation.

Implementation labor: This is where costs vary wildly. A straightforward Health Cloud deployment with standard objects and minimal integration runs $75,000-$150,000. A complex deployment with custom care coordination workflows, EHR integration, and Agentforce automation runs $250,000-$500,000.

Integration work: Health Cloud doesn't replace your EHR. It sits alongside it. You need integration via FHIR R4 APIs, HL7 feeds, or middleware (MuleSoft is the Salesforce-preferred path, at additional cost). Integration is typically 30-40% of total implementation cost.

Data migration and cleanup: Moving patient data from legacy systems into Health Cloud requires deduplication, field mapping, and validation. Budget $25,000-$75,000 depending on data quality.

Ongoing administration: Salesforce needs a dedicated administrator. Whether that's a full-time employee ($90,000-$130,000/year) or a fractional arrangement depends on your org size.

What drives cost up

Custom objects instead of standard ones. Health Cloud ships with a data model designed for healthcare: patient profiles, care plans, care teams, assessments, clinical alerts. Organizations that build custom objects instead of using the standard model add 40-60% to their implementation cost and create upgrade headaches for years.

Underestimating data quality. If your legacy system has duplicate patient records, incomplete insurance data, or inconsistent naming, those problems surface during migration. I've seen data cleanup consume 25% of a project budget because nobody scoped it.

Layering Agentforce before the basics work. Salesforce's AI agent product is powerful but it's a layer on top of a functioning Health Cloud deployment. If your care coordination workflows aren't clean, Agentforce will surface the messiness, not fix it. Get the foundation working first.

Fixed-bid contracts on undefined scope. If a systems integrator gives you a fixed price before understanding your org, they've priced in risk they don't understand. You'll either pay for their overestimation or eat their underestimation. A paid discovery phase ($10,000-$25,000) prevents both outcomes.

What a realistic timeline looks like

I tell clients to expect 4-9 months from kickoff to go-live for a mid-size deployment:

Weeks 1-4: Discovery, requirements, data model validation
Weeks 5-12: Configuration, custom development, integration development
Weeks 13-20: Integration testing, user acceptance testing, data migration
Weeks 21-36: Training, pilot, staged rollout

Anyone promising go-live in under 4 months is either skipping discovery, skipping testing, or deploying out-of-the-box Health Cloud with zero customization. The last option is fine if that's what you need. The first two are not.

How to control cost

Use the standard data model. Salesforce designed Health Cloud's schema for healthcare workflows. Customize fields and page layouts, not the underlying structure. This keeps your implementation faster and your upgrade path clean.

Run a paid discovery phase. Spend $15,000-$25,000 to understand your integration surface, data quality, and workflow requirements before committing to a number. This sounds like added cost. It saves 2-3x its price in scope changes during implementation.

Prioritize integrations. Not every integration needs to be live on day one. Phase your EHR integration, your analytics integration, and your patient portal. Get the clinical workflow working, then layer on the adjacent systems.

Hire a Salesforce architect, not just a developer. Architecture decisions made in the first three weeks of a project determine whether your implementation costs $150,000 or $400,000. An architect costs more per hour and saves more per project.

US implementation cost benchmarks

Based on rates I see in the market for US-based Salesforce Health Cloud architects and consultants:

US architect: $200-$300/hour
US senior consultant: $150-$200/hour
Offshore developer (through a US firm): $100-$150/hour
Offshore developer (direct): $50-$90/hour

The rate differential between US and offshore is real, but healthcare implementations require someone who understands HIPAA, clinical workflows, and compliance. Offshore development can work for well-specified configuration tasks. It should not own your architecture decisions.

If you're evaluating Health Cloud or in the middle of a deployment that's off track, that's the work I do. PumaTech handles Salesforce Health Cloud consulting, implementation, and integration for healthcare organizations.

What Is a Fractional CTO? (And When You Actually Need One)

Christopher Gainus — Thu, 06 Aug 2026 16:48:12 +0000

I take on a small number of fractional CTO clients through PumaTech. If your organization needs hands-on technology leadership without a full-time hire, reach out.

Is AI HIPAA Compliant? A Practical Guide for Healthcare Organizations (2026)

Christopher Gainus — Thu, 06 Aug 2026 16:47:27 +0000

When a clinic administrator asks "is ChatGPT HIPAA compliant?", the honest answer is no by default. Not because the technology can't handle it. Because compliance depends on configuration, contracts, and what data you feed it.

I've spent the last three years building AI systems for a Medicare Advantage primary care organization. Here's what I've learned about which tools you can use with PHI, which ones require a BAA, and which ones will get you fined.

HIPAA compliance is not a property of software

HIPAA doesn't certify products. It regulates how covered entities handle protected health information. A tool is "HIPAA compliant" when:

You have a signed Business Associate Agreement (BAA) with the vendor
The vendor agrees to safeguard PHI per HIPAA Security Rule requirements
You configure the tool to not retain or train on your data

A product can have every security certification in the industry and still produce a HIPAA violation if your staff paste patient names into it without a BAA in place.

Which AI tools have signed BAAs (as of 2026)

I'll be specific here because vague answers are what get clinics in trouble.

Microsoft Azure OpenAI: Yes. Microsoft offers a BAA through their Online Services Terms. Azure OpenAI does not train on your data by default. This is the most common path I see for healthcare organizations that want GPT-4 class models.

Google Cloud Vertex AI (Gemini): Yes. Google Cloud offers a BAA and will sign one for Vertex AI. Gemini data is not used for training when accessed through Vertex AI.

Anthropic Claude (via AWS Bedrock): Yes. AWS offers a BAA for Bedrock. Claude models accessed through Bedrock are covered. Claude accessed through the consumer website is not.

OpenAI ChatGPT: Not by default. The consumer ChatGPT product does not have a BAA. OpenAI does not offer a BAA for ChatGPT as of mid-2026. If you need GPT-4 for healthcare work, use Azure OpenAI instead.

Otter.ai: No BAA available. People search for this constantly (110 searches/month for "is Otter AI HIPAA compliant"). The answer is no. Do not use Otter for meetings where PHI is discussed.

Fireflies.ai: No BAA available. Same situation.

Plaud.ai: No BAA available.

Fathom: No BAA available as of mid-2026.

Granola: No BAA available.

The pattern: note-taking and transcription AI tools almost universally lack BAAs. This is a gap in the market, and it's why clinics keep asking.

How to deploy AI with PHI safely

The architecture I use in production:

Option 1: Azure OpenAI with a BAA. Route API calls through a backend proxy that strips identifiers before sending prompts. Configure Azure to disable data retention and training. Monitor usage logs for PHI leakage.

Option 2: Private LLM deployment. Run an open-weights model (Llama, Mistral) on infrastructure you control. No data leaves your network. No BAA needed because no third party processes the data. The tradeoff is higher operational cost and you need someone who can manage the infrastructure.

Option 3: LiteLLM routing to HIPAA-covered endpoints. Use LiteLLM as an API gateway that routes requests to Azure OpenAI or AWS Bedrock (both BAA-covered). LiteLLM handles the routing, rate limiting, and fallback. Your application talks to one endpoint. The data stays within BAA-covered infrastructure.

What actually gets clinics fined

It's almost never the AI tool. It's the workflow.

A clinician pastes a patient's medication list into ChatGPT to check for interactions. That's a PHI disclosure to a vendor without a BAA. The tool didn't fail. The process did.

I've seen this happen at organizations with otherwise strong compliance programs. The fix is not better AI. It's blocking access to non-BAA AI tools on work devices, providing a sanctioned alternative (Azure OpenAI proxy), and training staff on what they can and cannot type into an AI prompt.

Questions I get asked most

"Can I use Claude for clinical notes?"

Through the consumer website, no. Through AWS Bedrock with a BAA, yes. The model is the same. The compliance posture is entirely different.

"Is Gemini HIPAA compliant?"

Through Google Cloud Vertex AI with a BAA, yes. Through gemini.google.com, no. 20 people per month search this exact question. The distinction matters.

"Do we need an AI governance committee?"

Not a formal one on day one. But you need a named owner, a written policy on approved tools, and a vendor evaluation checklist that covers BAA terms, data retention, subprocessor disclosures, and breach notification windows.

Bottom line

The question isn't whether AI is HIPAA compliant. It's whether your deployment of it is. Microsoft, Google, and AWS all offer BAA-covered AI services that can handle PHI. The consumer tools you've heard of (ChatGPT, Otter, Fireflies) do not.

If you're a healthcare organization figuring out which AI tools you can actually use, that's the work I do. PumaTech builds and deploys HIPAA-compliant AI systems, data platforms, and Salesforce Health Cloud integrations for healthcare organizations.