Salesforce Health Cloud uses the power of the cloud, social and mobile technologies to give healthcare professionals the tools they need to collaborate more efficiently, understand patients more deeply, and build 1-to-1 relationships across entire care journeys. © SFDCGC92017
- Patient view - health timeline, demographics, communication preferences, clinical data
- Visual chart of patients extended care team: physicians, carers, coordinators
- Integration with electronic health records and device data
- “Today” page for easy management of all activities
- Intuitive real-time risk reporting to identify high-risk patients.
- Scalable platform for management of patient populations
- Customise care plan templates and measure effectiveness across populations
- Segmentation and smart rules for customisation of care plans
- Real-time communication platform for patients and carers
- Cloud and mobile enabled for unprecedented accessibility
- Smarter management and collaboration of patient activities in one place
- Reduce costs by proactively managing patients in most need
- Increased productivity for carers and responsiveness
- Effectively manage large patient populations
- Support better health outcomes with patient engagement
- Anticipate patient needs for better, more effective clinical decisions
- Integration gives up-to date and complete patient view
- Improve patient carer relationships
- Communicate and collaborate flexibly, at any time, on any device
- Empower patients to understand and achieve health goals
£84.02 per person per month
07748 105 950
|Software add-on or extension||Yes, but can also be used as a standalone service|
|What software services is the service an extension to||Salesforce services are modular, and functionality can be expanded as needed. Customers can extend by adding applications and functionality from our partner ecosystem. Further information here: https://appexchange.salesforce.com/|
|Cloud deployment model||Public cloud|
Considerations we wish to highlight (further detail in our Supplier Terms)
Services and content are subject to usage limits such as the quantities specified in order forms.
A user’s password may not be shared with any other individual.
Customisation and configuration of the service is independent of the underlying infrastructure.
Upgrades do not impact any changes you may have made. The service is automatically upgraded 3 times a year, this occurs out off office hours early at the weekend, whereby the service goes to read only mode for a few minutes.
|Email or online ticketing support||Email or online ticketing|
|Support response times||Every Salesforce service includes support as standard. The lowest level relies on the Salesforce user community for responses and has a response time of 2 business days, this can be reduced to 1 hour with the appropriate upgrade in your support plan.|
|User can manage status and priority of support tickets||Yes|
|Online ticketing support accessibility||None or don’t know|
|Phone support availability||24 hours, 7 days a week|
|Web chat support||Web chat|
|Web chat support availability||24 hours, 7 days a week|
|Web chat support accessibility standard||None or don’t know|
|How the web chat support is accessible||
Salesforce Web chat has not been specifically tested against usability standards; the Salesforce web chat Pre-Chat and Post-Chat forms are implemented through Salesforce's Visual Force Markup language, the presentation of which can be customised by the customer, giving them control over accessibility, including for example:
- providing text alternatives for any non-text content so that it can be changed into other forms people need, such as large print, braille, speech, symbols or simpler language. They can, for example, set Alt Tags on any images used on the forms or in the chat window.
- Ensuring that colour isn't the only means of conveying information and making contrast ratios between text and its background sufficient that it can be read by people with moderately low vision.
|Web chat accessibility testing||Salesforce has not conducted usability studies to verify that the online chat function works effectively with screen reading and other assistive technology. However, existing customers have conducted extensive testing and, for example, the Drive and Vehicle Licensing Agency has performed alpha and beta testing with GDS and has successfully implemented our web chat capabilities.|
|Onsite support||Yes, at extra cost|
|Support levels||Every Salesforce service includes community-based support. This can be enhanced with guaranteed response times through Premier and Premier+. For more critical applications we provide Signature Success which provides Salesforce staff with a knowledge of a specific customers applications and configurations and an initial response from your designated support team in as little as 15 minutes, with personalised updates every 30 minutes.|
|Support available to third parties||Yes|
Onboarding and offboarding
|Getting started||Salesforce's Customers for Life is designed to help customers be successful and get up and running quickly. A dedicated group is available for new customers to engage by asking questions, giving feedback, and sharing experiences. this also includes 'Getting started resources' further detail available at https://www.salesforce.com/success-gettingstarted/|
|End-of-contract data extraction||
There are a number of options available for customers to extract their data from the service, either during the contract or when the contract ends. We encourage customers to export their data during their contract on a periodic basis to maintain a local copy of their salesforce database, rather than wait until the end of the contract These options include:
The Weekly Export Service – export data from the service on a periodic basis via a zip file containing .csv files over a TLS link.
Export data over the API via an integration or middleware solution. A comprehensive Salesforce exit strategy paper is available on request.
|End-of-contract process||Upon contract termination with Salesforce, the customer's data on disk is flagged accordingly and set to inactive status also referred to as a "soft delete." This data is no longer available or accessible to the application but is backed up in the full backup process. The data remains in this state for 180 days; this is done in the event that the customer decides to resume services or needs the data for a legal reason. At 180 days, the data is marked for deletion ("hard delete") and will be deleted after 30 more days. Once this "hard delete" is executed the customer data is physically deleted and unrecoverable. Following the purge, the data will remain on backup for an additional 90 days prior to being unrecoverable from backup media. Salesforce encourages the customer to extract their data using one of the methods as described in this listing prior to terminating any contract/s.|
Using the service
|Web browser interface||Yes|
|Application to install||No|
|Designed for use on mobile devices||Yes|
|Differences between the mobile and desktop service||
The capability of Salesforce via a browser and on a mobile device, via either a browser or the native Salesforce1 App is broadly similar. However, there are some subtle differences as described here: https://help.salesforce.com/articleView?id=limits_mobile_sf1_data.htm&language=en_US&type=0.
Note that the salesforce browser UI can also be accessed on many mobile devices.
|Accessibility standards||WCAG 2.0 AA or EN 301 549|
The Voluntary Product Accessibility Template (VPAT) is a standardised form developed in partnership by the Information Technology Industry Council (ITI) and the U.S. General Services Administration (GSA) to document a product’s conformance with key regulations of Section 508 of the Rehabilitation Act. These documents describe how federal agencies can use Salesforce accessibility features.
A third party vendor has completed an accessibility assessment of salesforce.com’s core CRM products and has documented their accessibility status using the VPAT documents published here: https://www.salesforce.com/company/legal/508_accessibility.jsp
|What users can and can't do using the API||
Salesforce open, standards-based APIs support a range of user integration requirements. The following list of APIs are available.
* REST API - Access objects in your organization using REST.
* SOAP API - Integrate your organization’s data with other applications using SOAP.
* Tooling API - custom development tools for Force.com applications. Coming soon!
* Chatter REST API - Access Chatter feeds and social data such as users, groups, followers, and files using REST.
* Bulk API - Load or delete large numbers of records.
* Metadata API - Manage customizations in your org and build tools that manage the metadata model (not the data, itself).
* Streaming API - Provide a stream of data reflecting data changes in your organization.
* Apex REST API - Build your own REST API in Apex. This API exposes Apex classes as RESTful Web services.
* Apex SOAP API - Create custom SOAP Web services in Apex. This API exposes Apex classes as SOAP Web services.
* Data.com API - Data.com provides 100% complete, high quality data, updated in real-time in the cloud, and with comprehensive coverage worldwide.
|API documentation formats||
|API sandbox or test environment||Yes|
|Description of customisation||
Point-and-click configuration: The Salesforce platform makes it easy to modify the functionality of Salesforce applications to meet your unique requirements. Working with the metadata framework and a series of simple point-and-click wizards, you can design custom user interfaces and modify the structure of the data model and the application’s business logic. Configuration enables organisations to modify objects, fields, validation rules, workflow, security settings, formulas, and much more without the need for code.
Customise with code: Although point-and-click configuration with the Salesforce platform is the fastest and easiest way to customise, some functionality is beyond the constraints of a metadata framework. For such cases, developers can create needed functionality in open-ended development environments, using toolkits for most of the common programming languages, or Apex.
|Independence of resources||
The current daily transaction average for our platform is regularly 5 billion, consistently at sub 250ms response time within the Salesforce environment. Within each logical system, we use load balancers to distribute load among multiple web and application servers for additional scalability and redundancy. The multitenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees fast performance.
In addition to scaling for growth, Salesforce continually strives to improve the average response time of our services and to back up our claims, full details of transaction volumes and response times are publically reported in real-time at http://trust.salesforce.com/trust/status/.
|Service usage metrics||Yes|
The service includes various metrics to monitor usage and adoption of the service, for example, last login, login duration etc.
For Infrastructure detail metrics are available at https://trust.salesforce.com website provides performance and availability information for the entire service.
For specific metric monitoring and for more in-depth detail customers can extend capability through the use of Event Monitoring. For example - which applications are being used, by whom, how are they being used, when, where from and are there performance issues? This data can be used to improve adoption, security and performance of the application.
|Reporting types||Real-time dashboards|
|Supplier type||Not a reseller|
|Staff security clearance||Conforms to BS7858:2012|
|Government security clearance||Up to Developed Vetting (DV)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||
|User control over data storage and processing locations||Yes|
|Datacentre security standards||Complies with a recognised standard (for example CSA CCM version 3.0)|
|Penetration testing frequency||At least every 6 months|
|Penetration testing approach||‘IT Health Check’ performed by a CHECK service provider|
|Protecting data at rest||Physical access control, complying with CSA CCM v3.0|
|Data sanitisation process||Yes|
|Data sanitisation type||Deleted data can’t be directly accessed|
|Equipment disposal approach||Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001|
Data importing and exporting
|Data export approach||Data can be exported via the API (e.g Weekly Export Service mentioned above) or for a more standard user, they can generate a report and export that report. There are features available that would enable an administrator to monitor, and in some cases prevent, the exporting of sensitive data in this regard.|
|Data export formats||
|Other data export formats||
|Data import formats||
|Other data import formats||
|Data protection between buyer and supplier networks||
|Other protection between networks||
By default, customer connect to the service over the public Internet with all transmissions between the user and the Salesforce Services secured using TLS 1.0 or higher and encrypted using 256 or 128-bit encryption. The Services use International/Global Step Up SSL certificates with 2048-bit Public Keys. Web Service callouts can be secured using TLS, as well as with two-way TLS,
In addition, customers can partner with a selection of supported ISPs for a more direct connection to the Salesforce service. In the UK, BT are one such ISP. This service is known as Salesforce Express Connect.
|Data protection within supplier network||Other|
|Other protection within supplier network||Customer data is protected within the Salesforce service through a mature, standards-based defence in depth security architecture. Logical and physical access is strictly controlled and monitored and the controls used are in scope for the various security certifications the company has, and audited regularly by third parties. Controls such as firewalls, intrusion detection, anti-malware, file integrity monitoring are augmented with extensive monitoring to provide a robust prevention, detection and response model. Internal and external, as well as third-party vulnerability scanning and application penetration testing are also in place.|
Availability and resilience
The Salesforce Services are designed with the concept of continuous improvement and Trust (e.g. Availability, Performance and Security) in the infrastructure. Salesforce uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events.
Excellent availability statistics (historically 99.9%) are critical to Salesforce's customers’ success and to the success of Salesforce as a company. Salesforce generally does not focus on a specific percentage, as we do not believe our job on availability will ever be “complete”. Live and historical statistics on Salesforce system performance are publicly published at: https://trust.salesforce.com/en/#systemStatus, and further detail can be shared upon request and NDA.
|Approach to resilience||To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy, help to minimise the risk of single points of failure, and provide a highly resilient environment with maximum uptime and performance.|
|Outage reporting||Outage escalation policies are established and maintained as Salesforce's goal is to rapidly restore service. In the event of an extended outage, periodic updates are provided in near real time to customers via the trust.salesforce.com dashboard site and in addition, service notifications are provided to nominated contacts via various channels such as email. Update frequency for notifications is dependent on the customer support service plan.|
Identity and authentication
|User authentication needed||Yes|
|Other user authentication||Salesforce has a very comprehensive set of authentication mechanisms that customers can chose from. These include the inherent username and password option, Single Sign-on, Social Sign-on through another application, such as google, integration with existing identity management systems a customer may have, 2 Factor Authentication, and the application can also act as a Service Provider or Identity Provider for SSO integration using SAML.|
|Access restrictions in management interfaces and support channels||
Management access for service support and delivery is done through multiple layers of controls including, but not limited to, multiple 2 factor authentication, bastion host and proxy control and segregation of duties. These controls are in scope for SSAE auditing and evidences through the SOC 2 report.
Access to the management interface for the customer to configure their salesforce environment, is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
|Access restriction testing frequency||At least every 6 months|
|Management access authentication||
Audit information for users
|Access to user activity audit information||Users have access to real-time audit information|
|How long user audit data is stored for||User-defined|
|Access to supplier activity audit information||Users have access to real-time audit information|
|How long supplier audit data is stored for||At least 12 months|
|How long system logs are stored for||At least 12 months|
Standards and certifications
|ISO/IEC 27001 certification||Yes|
|Who accredited the ISO/IEC 27001||Schellman & Company, LLC (Formerly BrightLine)|
|ISO/IEC 27001 accreditation date||22/04/2016|
|What the ISO/IEC 27001 doesn’t cover||The only ISO27001 control not included in our Statement of Applicability is A.14.2.7 - Outsourced Development. This is not covered as Salesforce does not perform outsourced system development.|
|ISO 28000:2007 certification||No|
|CSA STAR certification||Yes|
|CSA STAR accreditation date||02/02/2017|
|CSA STAR certification level||Level 1: CSA STAR Self-Assessment|
|What the CSA STAR doesn’t cover||The available CSA STAR self-assessment covers all points in the latest CCM; version 3.01.|
|Who accredited the PCI DSS certification||Schellman & Company, LLC (Formerly BrightLine)|
|PCI DSS accreditation date||01/09/2016|
|What the PCI DSS doesn’t cover||This service is PCI DSS compliant. All controls for PCI DSS are in scope for this service, there is nothing not covered.|
|Other security accreditations||Yes|
|Any other security accreditations||
|Named board-level person responsible for service security||Yes|
|Security governance accreditation||Yes|
|Security governance standards||
|Other security governance standards||
|Information security policies and processes||Salesforce's Information Security Management System (ISMS) and information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. As required by this certification, the ISMS is endorsed by Senior Management. The EVP of Security has responsibility for the information security policies and ISMS. The Trust Strategy Alignment (TSA) Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), Senior Management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.|
|Configuration and change management standard||Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402|
|Configuration and change management approach||
Salesforce has formal processes for placing a system into production. This procedure includes a build checklist, server hardening checklist and pre-production testing. Baseline configurations for servers, network devices, and databases are consistent with industry-accepted CIS (Center for Internet Security) system hardening guidelines.
Change control procedures are required by the company’s Change Management Policy and include steps for testing, review, authorization, communication, verification, and back-out procedures. All changes to the infrastructure components are tested in a dedicated environment using production class equipment before being deployed into production. Changes are reviewed and approved by Technical Operations management prior to deployment to production.
|Vulnerability management type||Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402|
|Vulnerability management approach||
There are various vulnerability management processes in place around internal scanning, external scanning vendor patch release management.
Salesforce technical operations and security personnel monitor vulnerability alerts and patch release notifications from our vendors and other sources, and there are associated evaluation and deployment processes in place. Salesforce also regularly performs self-vulnerability assessments using various tools and techniques, including tools such as Qualys. In addition, Salesforce uses external service providers to perform an application vulnerability assessment after each major release (three times annually) and network vulnerability assessments quarterly. There is also an on-going external application scanning service used.
|Protective monitoring type||Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402|
|Protective monitoring approach||Salesforce's Computer Security Incident Response Team (CSIRT) uses a security event logging and management system to manage the alerts and logs generated by devices on our network and provide protective monitoring. The system consists of a central database, management server, and distributed agents. The distributed agents receive events from network devices and systems (firewalls, IDS, routers, switches, hosts, file integrity, and database monitoring) on the network, then compress, encrypt, and transmit the data to the management server and database for processing. Correlated events are configured to generate alerts and logs which are monitored on a 24/7 basis.|
|Incident management type||Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402|
|Incident management approach||
Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities.
Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.
Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.
|Approach to secure software development best practice||Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)|
Public sector networks
|Connection to public sector networks||No|
|Price||£84.02 per person per month|
|Discount for educational organisations||No|
|Free trial available||Yes|
|Description of free trial||The Salesforce Health Cloud trial version is fully configured and highlights many of the capabilities through sample data examples.|
|Link to free trial||A trial version of the service maybe available depending on the specifics required, please contact us for further information.|
|Pricing document||View uploaded document|
|Skills Framework for the Information Age rate card||View uploaded document|
|Service definition document||View uploaded document|
|Terms and conditions document||View uploaded document|