The Permission Model Is the Product: Occupational Health Case Management on Salesforce

An occupational health case moves through examination, restriction, treatment and return to work. Five roles touch it: a physician, a nurse, a case manager, the employer and a safety officer. Each one needs a different slice of the same record, and one of them must never see the diagnosis.

That sentence is the whole engineering problem. The employer is entitled to know whether a worker can lift, climb or drive. The employer is not entitled to know why. If that distinction is not expressed in the data model, no amount of sharing rules will hold it.

Spreadsheets fail for a reason that is not convenience

Shared drives and paper forms do not fail because they are old. They fail because they cannot enforce who sees what, and they cannot prove afterwards who looked. Both halves matter. An audit question six months later is answered from a system or it is not answered at all.

Model the case as several objects, not one

The temptation is a single fat record with a hundred fields. It is faster to build and it leaks immediately, because the moment the employer is allowed to see the restriction they can also see whatever clinical field sits beside it.

What works instead:

• separate objects for the case, the encounter, the exposure event, the restriction, the surveillance result, the employer account and the worker record
• junction objects for the common real world case where the employer of record is not the site where the work happens
• restrictions that carry a start date, an end date and a review owner, so an expired restriction is a state rather than a note somebody forgot

Record types and field level security then have something real to attach to. Employers see fitness and restriction outcomes. Clinical detail stays with clinical roles.

Governed picklists are a privacy control

Free text classification is usually argued about as a reporting problem. It is worse than that. Somebody types a diagnosis into a logistics notes field, and now the sensitive detail lives in a field that nobody classified as sensitive and no sharing rule protects.

Replacing free text with governed picklists fixes the reporting and closes that hole at the same time.

Put regulated thresholds in data, not in code

Take blood lead level monitoring as the example. Enrollment, testing frequency, thresholds and follow up actions are all rules that change when a regulation changes.

If they live in code, every regulatory update is a release, and under deadline pressure somebody adds a field to an existing object that quietly inherits whatever sharing that object already had. That is how a privacy regression ships.

If they live as records, the update is a configuration edit. The periodic reports come off the same records, so the report and the rule cannot drift apart.

Correspondence belongs to the case

Inbound and outbound fax and email get logged as case activities rather than living in somebody's mailbox. Documents hang off the case with version history, classification and retention rules. This is unglamorous and it is the part that answers the audit.

Give outsiders a surface built for outsiders

Employers and referring clinicians need real time visibility. The wrong answer is a stripped down copy of the internal application with fields hidden by CSS. The right answer is an external community, which gives them a purpose built surface and does not consume internal user licences.

Migration is where the old sins surface

Legacy data arrives with duplicates and years of free text classifications that now have to map onto a governed vocabulary. Some of it will not map cleanly, and that is a decision for a human, not a script.

Rehearse the whole thing in a full sandbox and validate historical caseloads before cutover. The migration is also the only moment you get a clean look at how bad the old classification really was.

The rule worth keeping

Design the permission model before you design a single screen. Everything else in this build is downstream of that one choice, and it is the only part that is genuinely expensive to retrofit.

Full write up: Occupational Health Case Management Platforms on Salesforce

Where do you draw the line between what an employer is entitled to see and what stays clinical?