Authentication, session controls and security baseline for health users
Key Takeaway
Salesforce secures the platform, but the customer must configure authentication, session settings and access controls on top of it.
Agentforce Health orgs store protected health information. A consultant must design how users prove who they are, how their sessions are protected after login, and how the org's security settings compare to a known standard. Security Health Check scores those settings. The Identity Verification feature covers a separate need: confirming who a caller is before a service agent shares health details.
Who secures what
Security follows a Shared Responsibility Model, which splits the work between Salesforce and the customer.
| Secures | Covers | |
|---|---|---|
| Salesforce | The platform | Infrastructure, patching and compliance certifications |
| The customer | What runs on the platform | Configuration, access controls, custom code and data governance |
Salesforce's HIPAA support applies to HIPAA-eligible services covered by a Business Associate Agreement (BAA). The customer still owns the obligations attached to its own data.
For every production org, set a security contact to receive critical security alerts, vulnerability notifications and incident communications.