Health-Cloud-Accredited-Professional Practice Questions

When complying with HIPAA using Salesforce Shield, Bloomington Caregivers must:

Encrypt sensitive data in transit and at rest:

Shield Platform Encryption ensures encryption at rest; Salesforce uses TLS for encryption in transit.

Extract:

“Salesforce Shield encrypts sensitive data at rest. Salesforce also encrypts data in transit using TLS.”

( Source: Salesforce Se curity Guide , Shield Platform Encryption Guide )

Implement and regularly review audit trails:

Shield Event Monitoring and Field Audit Trail help monitor data access and modifications.

Extract:

“Implement audit trails and monitor them to detect unauthorized or suspicious activities.”

([Source: Salesforce Security Guide, Shield Platform Encryption Guide])

Configure data retention policies:

Retain records for legally required periods to comply with HIPA

A.  

Extract:

“Data retention policies must comply with legal and regulatory requirements, including HIPA

A.  

([Source: Salesforce Security Guide])

Why not B or C?

Providing access to third-party auditors is not a Salesforce Shield requirement; such reviews are typically handled internally.

Using third-party backup solutions is not a core Shield/HIPAA control within Salesforce, and data residency must be managed with care.

Step 1: Requirement Analysis

After deploying a care plan template (including problems, goals, and tasks) via Data Loader to the final environment, users must be able to use the new template for creating care plans in production.

Step 2: Salesforce Health Cloud Documentation Guidance

According to the official Health Cloud administration guide, two key post-deployment steps are required:

1. Confirm User Access to Care Plan Objects

Users must have the correct permissions to view, create, and use care plan templates and related records. This involves assigning the appropriate permission sets or profiles to allow access to the Care Plan , Care Plan Template , and related objects.

Extract:

“Ensure users have the necessary permissions to access care plan templates and related objects so they can view and apply templates to patients’ care plans.”

Administer Health Cloud – Care Plans and Permissions

2. Activate the New Care Plan Template

Templates (and their related records) must be activated after being deployed to make them available for use by end users. Care plan templates in Salesforce Health Cloud have an “Active” status that must be set to “True” or “Activated” before users can select them when creating new care plans.

Extract:

“After importing care plan templates and related data, administrators must activate the template to make it available to care coordinators and clinicians.”

Administer Health Cloud – Deploying and Activating Care Plan Templa tes

Other Options:

B.  

Activate the problems, goals, and tasks associated with the template: Not required as a separate step. When you activate the care plan template, its associated problems, goals, and tasks become available.

D.  

Conduct end-user training: While important, it is not a required technical step for enabling the template after deployment.

Verified Answers:

A.  

C.  

When onboarding Health Cloud into an org that already uses Service Cloud , it’s critical to properly configure Organization-Wide Defaults (OWD) to ensure that protected health information (PHI) remains restricted.

The correct settings are:

A.  

Set Person Accounts to Private

Patients are modeled as Person Accounts in Health Cloud.

Setting Person Accounts to Private ensures PHI isn’t exposed to users outside the Health Cloud business unit.

B.  

Set related clinical objects to Controlled by Parent or Private

Clinical objects (e.g., Care Plans, Assessments, Referrals) often relate to patients.

Making them Controlled by Parent (Person Account) or Private ensures only authorized users can see PHI.

E.  

Set Health Details to Controlled by Parent or Private

Health Details contain sensitive clinical data .

Must be restricted at the OWD level to prevent exposure to non-Health Cloud users.

Why not the others?

C.  

Set Account and Contract to Private

Regular business Accounts/Contracts are part of Service Cloud, not typically where PHI resides. Restricting them isn’t required for PHI protection.

D.  

Set Contact to Controlled by Parent

Contacts in Health Cloud are often caregivers or providers, not patients (who are Person Accounts).

PHI protection centers around Person Accounts + Clinical Objects + Health Details , not Contacts.

Salesforce Health Cloud Reference:

???? Salesforce Health Cloud Security and Sharing Guide:

“For HIPAA and other PHI compliance, set Person Accounts and Health Cloud clinical objects to Private or Controlled by Parent .”

“Ensure Health Details are not exposed via default sharing.”