A customer that already has Service Cloud is onboarding a new business unit, which needs...

When onboarding Health Cloud into an org that already uses Service Cloud , it’s critical to properly configure Organization-Wide Defaults (OWD) to ensure that protected health information (PHI) remains restricted.

The correct settings are:

A. Set Person Accounts to Private

Patients are modeled as Person Accounts in Health Cloud.

Setting Person Accounts to Private ensures PHI isn’t exposed to users outside the Health Cloud business unit.

B. Set related clinical objects to Controlled by Parent or Private

Clinical objects (e.g., Care Plans, Assessments, Referrals) often relate to patients.

Making them Controlled by Parent (Person Account) or Private ensures only authorized users can see PHI.

E. Set Health Details to Controlled by Parent or Private

Health Details contain sensitive clinical data .

Must be restricted at the OWD level to prevent exposure to non-Health Cloud users.

Why not the others?

C. Set Account and Contract to Private

Regular business Accounts/Contracts are part of Service Cloud, not typically where PHI resides. Restricting them isn’t required for PHI protection.

D. Set Contact to Controlled by Parent

Contacts in Health Cloud are often caregivers or providers, not patients (who are Person Accounts).

PHI protection centers around Person Accounts + Clinical Objects + Health Details , not Contacts.

Salesforce Health Cloud Reference:

???? Salesforce Health Cloud Security and Sharing Guide:

“For HIPAA and other PHI compliance, set Person Accounts and Health Cloud clinical objects to Private or Controlled by Parent .”

“Ensure Health Details are not exposed via default sharing.”