OmniStudioArchitect (Hardest)omniscriptsecurityhipaa
Design OmniScript save-resume session security for HIPAA-regulated health applications
Real World Scenario
Member saves enrollment OmniScript mid-session; security review flags PHI in browser sessionStorage accessible on shared family device.
Expected Answer
• Server-side saved session OmniStudio native not client localStorage PHI
• Resume requires re-authentication MFA for PHI steps
• Session timeout 15 minutes inactive auto-save server
• Minimal PHI in client JSON mask SSN display last four only
• Audit log save resume events user timestamp IP
• Clear client state on logout explicit session invalidate
• BAAs cover OmniStudio data at rest encryption verify
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Direct answer: Server-side saved session OmniStudio native not client localStorage PHI Also consider: Resume requires re-authentication MFA for PHI steps In practice: Session timeout 15 minutes inactive auto-save server Document the decision in an ADR and align with enterprise standards.
Architect Perspective
Save-resume convenience vs HIPAA—server-side session with re-auth beats client PHI storage.