Guest and site user access for public-facing health sites
Key Takeaway
Object Read isn't enough for guests: the only way to share records with them is a guest user sharing rule, which grants Read Only access.
A public-facing health site is an Experience Cloud site where some pages work without logging in, such as a page where new providers apply to join a payer's network. Anonymous visitors use the site as a guest user, while logged-in site members get access through their own profile, permission sets, and sharing. Guest access starts fully locked down, so the consultant decides how little to open for each public step.
One guest user per site
Salesforce creates a guest user profile and exactly one site guest user record for every Experience Cloud site, even when the site isn't set up for public access. Every anonymous visitor to that site uses the same guest user record, so all guests share one access level.
Guest user profiles are site-specific. For example, a provider portal and a patient site in the same org each have their own guest user profile, so you review and secure each one separately.
Guest defaults are as restrictive as Salesforce can make them, so opening anything up is your decision. Configure the guest user profile before you publish a site with public access enabled.