Healthcare security design should begin with the customer ' s actual data-security, privacy, regulatory, and visibility requirements and should be reviewed periodically as those requirements change. Sharing settings, permissions, field-level security, and other controls must evolve with organizational policies and regulations. Salesforce Data Mask is intended for masking sandbox data, not as a production PHI access-control strategy. From a solution-design perspective, the selection fits the requirement because it uses the Health Cloud capability or data model that directly represents the business need, rather than introducing a parallel custom structure or a feature intended for a different stage of the patient, member, provider, or payer lifecycle. The remaining options do not directly satisfy the stated requirement; they either address a different functional domain, provide only part of the required behavior, or introduce unnecessary customization compared with the selected Health Cloud approach. This approach also keeps the solution aligned with the standard Agentforce Health data and process model, which is important for maintainability, reporting, interoperability, and consistent user access. In practical terms, the consultant should configure and validate the selected elements (Regularly review and update security, sharing, and visibility settings in Health Cloud to align with evolving needs, regulations, and organizational policies.; Understand customer needs, data security, privacy concerns, regulatory compliance, and sharing or visibility restrictions.) against the scenario ' s acceptance criteria and confirm that the intended users can access the underlying records and functionality.
Study Guide references/topics:Design - Security; Sharing; Permissions
===============
