Q: My company sells to the healthcare industry. Is it a HIPAA violation when my Customer Service Rep replies to a support ticket on Service Cloud? I mean, Salesforce is HIPAA compliant, right?
A: You very well may be in violation of HIPAA standards. Here’s why.
Yes, the Salesforce platform itself can be made HIPAA compliant. Salesforce will sign a Business Associates Agreement (BAA) and if you connect Shield as an addon HIPAA compliance tool, you’ll get monitoring, encryption, and auditing functionality of your Salesforce instance. But that’s only part of the compliance requirements story because it only covers the data while it’s residing within the Salesforce data storage ecosystem – the data at rest.
HIPAA also applies to data in motion. Simply stated; data containing protected health information traveling over a public network (like the Internet) must be encrypted in transit.
So let’s take a look at your scenario: Suppose you’re a customer service account representative using Service Cloud to view a new support ticket. A customer sends an inquiry explaining that his doctor wants him to get additional testing to rule out prostate cancer and he wants to know if his insurance covers the new tests. The customer’s contact information plus a medical condition equals Protected Health Information (PHI) and needs to comply with HIPAA guidelines.
While you’re viewing the information on Service Cloud, it’s covered by HIPAA (see the first paragraph above). But when you reply to that ticket the PHI is almost always copied as part of the ongoing dialogue thread and is sent from your company to the customer via email or other messaging format. It’s now data in motion traveling over the Internet, and your company (not Salesforce) is responsible to encrypt the message before it’s sent in order to be HIPAA compliant.
Luckily, there are solutions, like DataMotion SecureMail, that integrate easily with Salesforce and Salesforce Marketing Cloud, and have the ability to filter by policy rules and keywords and automatically encrypt messages containing PHI. Our solution also adds event monitoring, logging, and tracking for better visibility and governance (proof you need in the event of a HIPAA audit by the feds)!
Summary
Yes, the Salesforce Platform can be made HIPAA compliant. But when you reply to a Service Cloud ticket, that’s data in motion and it’s not Salesforce’s responsibility to encrypt that data. Your company needs to ensure those messages are encrypted between Salesforce, or any customer relationship management platform, and your customers. If not, you’re subject to fines, penalties, data breaches, and loss of reputation.
Frequently Asked Questions
Is Salesforce Service Cloud HIPAA compliant?
The Salesforce platform can be made HIPAA compliant. Salesforce will sign a Business Associate Agreement, and adding Shield provides encryption, monitoring, and auditing. However, that only covers protected health information while it is data at rest within the Salesforce ecosystem, not when it leaves.
Can replying to a Service Cloud support ticket cause a HIPAA violation?
Yes. When you reply to a ticket containing PHI, that data is copied into the thread and sent over the Internet as data in motion. Your company, not Salesforce, is responsible for encrypting those outbound messages, so an unencrypted reply can violate HIPAA.
Who is responsible for encrypting PHI sent from Salesforce to customers?
Your organization is. Salesforce protects data stored within its platform, but once a message containing PHI travels over a public network to a customer, your company must ensure it is encrypted in transit to stay HIPAA compliant.
How can I make Salesforce messages HIPAA compliant?
Use a solution like DataMotion SecureMail that integrates with Salesforce and Marketing Cloud. It can filter by policy rules and keywords to automatically encrypt messages containing PHI, and it adds event monitoring, logging, and tracking to provide proof during a HIPAA audit.
