A CRM is not HIPAA compliant because a vendor says so. It is suitable for patient data only when three things are true: the vendor signs a business associate agreement, its safeguards meet the HIPAA Security Rule, and your practice configures and uses it correctly. The sections below give staff a short test for judging a CRM.
What is a HIPAA-compliant CRM?
A HIPAA-compliant CRM is customer relationship management software that a practice can use with patient data because the vendor has signed a business associate agreement and the system, as configured and used, applies the safeguards HIPAA requires for electronic protected health information.
A CRM tracks contacts, leads, referrals, and follow-ups. In healthcare, those contacts are often patients or prospective patients.
"HIPAA-compliant CRM" is industry shorthand. HIPAA does not define a product category, and there is no official product certification. Whether a particular CRM is appropriate depends on three things: the vendor's business associate agreement (BAA), the vendor's safeguards, and how the practice uses the tool.
The main benefit is consolidation. Patient contact history, referral tracking, and recall or reminder follow-up can stay in one covered system, so staff do not move PHI into spreadsheets or other tools that have no BAA.
In practice at a clinic or small practice
Front desk staff and office managers use a CRM to:
- Log inquiries from new patients
- Track referrals from other providers
- Run recall lists, such as annual visit reminders
A patient's name combined with an appointment reason or condition is protected health information (PHI). A CRM that holds those records needs to be covered by a BAA.
Common traps:
- Exports to uncovered tools. Marketing staff export a patient list to an email tool that has no BAA.
- Integrations outside the BAA. Connected integrations, form builders, and automation tools usually sit outside the CRM vendor's BAA. Each one needs its own BAA with that vendor.
- The wrong plan. A free or lower-tier plan may not include a BAA.
- Outreach that needs authorization. Some patient outreach counts as marketing and requires the patient's written authorization. Whether recall and reminder messages count as marketing depends on their content and purpose, so confirm the classification with your privacy officer before sending.
Before anyone enters patient data, staff should be able to answer four questions:
- Do we have a signed BAA for the plan we actually pay for?
- Which features and integrations does the BAA cover?
- Who has access, and is that access limited to their role?
- Is access removed the day someone leaves?
Not to be confused with
| Term | What it is | How it differs from a CRM |
|---|---|---|
| Patient portal | A patient-facing system for records, messages, and bills, usually tied to the EHR | A CRM is a staff-side tool for managing relationships and outreach |
| EHR/EMR | The clinical record | A CRM should not hold clinical documentation and does not replace the EHR |
| HIPAA-compliant messaging | Staff or patient conversations | Messaging does not manage contacts or a referral pipeline |
What the rules say
- The vendor is a business associate. A CRM vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate.
- A BAA comes first. The covered entity must have a written business associate agreement in place before PHI goes into the system.
- Both sides apply safeguards. The vendor and the practice must apply administrative, physical, and technical safeguards to ePHI. Examples include access controls, audit controls, and transmission security.
- Marketing generally needs authorization. Using PHI for marketing generally requires the patient's authorization, with defined exceptions.
- HHS does not certify products. HHS does not certify or endorse any product as HIPAA compliant.
- Encryption does not remove BAA duties. A cloud vendor that stores encrypted ePHI is still a business associate.
A signed BAA does not make a practice HIPAA compliant by itself. The practice remains responsible for its own policies, access management, and staff training.
Related reading
- Business associate agreement (BAA): what the contract must contain.
- Protected health information (PHI) and ePHI: what counts as patient data in a CRM.
- Popular tools checked for HIPAA: how to assess a vendor's BAA scope.
- For an example of how a vendor documents BAA scope and safeguards, see how a BAA and safeguards work for a staff tool.
More terms: Healthcare operations glossary
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.