A dental CRM tracks the people who contact your practice before they are patients: the web form at 10 p.m., the chat message about an implant consult, the caller who asked about Saturday hours and never booked. Your practice management software doesn't see those people until someone enters them into the schedule. "Dental crm," "crm for dentists" and "dentist crm" each draw about 110 US searches a month, and advertisers pay about $47.53 a click for them (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
This guide separates the two systems, lists the HIPAA must-haves and shows how lead-to-patient tracking works. It is part of our dental marketing hub; the cross-specialty version is our patient CRM guide.
Practice management software vs a marketing CRM
Practice management systems such as Dentrix, Eaglesoft and Open Dental run the clinical and business side of a patient who is already in your schedule: appointments, charting, treatment plans, claims and billing. A marketing CRM covers the earlier stretch, from first contact to first visit.
| Item | Practice management software | Marketing CRM |
|---|---|---|
| Who is in it | Scheduled and existing patients | Leads: people who asked but haven't been seen |
| Main job | Scheduling, charting, billing, insurance | Capturing requests, follow-up, source tracking |
| Key question it answers | What care did this patient receive? | Where did this lead come from, and did they book? |
| Typical users | Whole clinical and front-desk team | Front desk, office manager, marketing lead |
Most practices need both, and a lead becomes a patient record in the practice management system once they book. What good looks like: every request lands in one place, has an owner within minutes, and ends with a recorded outcome.
What a dental CRM should track: lead, source, first visit
A lead record needs only a few fields. Collect the minimum you need to call back and book.
- Contact: name, phone, email and preferred contact method.
- Reason: new-patient exam, emergency, implant consult, aligners, children's visit.
- Source: the channel and page the person came from, such as Google Business Profile, Google Ads or an implant page.
- Timing: when the request arrived and when someone first replied.
- Status: new, contacted, scheduled, attended, treatment accepted, or lost with a reason.
- Owner: the team member responsible.
With those fields you can answer the questions that matter: how many web leads became first visits last month, from which source, and how long they waited for a reply. Our guide to how you convert more dental leads shows where those numbers point.
HIPAA requirements: BAA, access controls and where data lives
A request that mentions a broken tooth or an implant consult, sent to a dental practice, is protected health information (PHI). The vendor that stores it on your behalf is a business associate, and HHS lists a "cloud service provider engaged to create, receive, maintain, or transmit electronic PHI" among its examples (HHS business associate guidance (opens in a new tab)).
The HIPAA Security Rule requires administrative, physical and technical safeguards (HHS Security Rule summary (opens in a new tab)). For a CRM, the must-haves are:
- A signed BAA before any patient data enters the system.
- Role-based access so only authorized staff see lead details; the rule requires access controls that "allow only authorized persons to access ePHI."
- Audit controls that record who viewed or changed a record.
- Encryption in transit and at rest. HHS notes that a cloud vendor storing only encrypted data without the key is still a business associate (HHS cloud computing guidance (opens in a new tab)).
- A known data location. HIPAA has no specific rule against storing ePHI outside the US, but HHS says risks "may vary greatly depending on its geographic location," which your risk analysis has to consider.
Our HIPAA-compliant CRM checklist turns this into vendor questions, and our page on HIPAA for dental offices covers the marketing side more broadly.
Getting website forms and messages into one inbox
Leads scatter when each channel has its own home: form emails in one mailbox, chat transcripts in another tool, voicemails on the phone system. Pull them together:
- Website forms post straight into the CRM rather than into a general email account.
- Email alerts say "New request received" with a link to the secure inbox, without the form contents.
- Chat conversations from your website land in the same inbox.
- Phone inquiries that don't book get logged by the front desk with the same fields.
- Tracking scripts stay off form pages. HHS guidance says tracking technologies can collect PHI, such as an email address or a reason for seeking care, when someone requests an appointment through a website (HHS tracking guidance (opens in a new tab)).
Follow-up workflows for new-patient requests
Illustrative example: a new-patient request workflow
- Request arrives; the CRM assigns it to the front-desk owner on shift.
- First call within the hour during office hours; overnight requests first thing next morning.
- No answer: second call later the same day, then one written follow-up through the channel the person chose.
- Booked: the lead is marked scheduled and entered into the practice management software.
- After the first visit: mark attended; if treatment was presented, record accepted or pending.
- Not booked after three attempts: mark lost with a reason, such as insurance, cost, timing or no response.
HHS says providers may use email with patients if they apply reasonable safeguards, and that when a patient initiates contact by email, the provider can assume email is acceptable unless the patient says otherwise (HHS FAQ (opens in a new tab)). Keep written follow-ups short and leave clinical detail for the call.
Comparing dental CRM options
Compare on criteria, not feature counts:
| Criterion | What to ask |
|---|---|
| Lead capture | Do website forms and chat arrive directly, without copying? Can the front desk log phone inquiries? |
| Source attribution | Does each lead carry its channel, campaign and landing page? Can you report first visits by source? |
| HIPAA / BAA | Will the vendor sign a BAA for the plan you're buying? Is there role-based access and an audit log? Where is data stored? |
| Integrations | Does it connect to your website, scheduling tool and practice management system, and what data moves between them? |
| Pricing model | Per user, per location, per contact or bundled? What do setup, integrations and text messages add? |
Evaluation checklist
- The BAA is signed before setup, not promised for later.
- Each staff member has their own login and permissions.
- You can export your data if you leave.
- Reports show first visits and outcomes, not just lead counts.
Cost drivers
- Number of users or locations.
- Whether the BAA requires a higher tier.
- Text-messaging volume, which some vendors bill separately.
- Integration and migration work.
Red flags
- A badge claiming the product is certified for HIPAA. No such certification exists.
- A vendor that won't sign a BAA, or signs one only for some features.
- Shared logins at the front desk.
- Lead data, including emails or phone numbers, sent to ad platforms.
Not sure where leads are slipping today? A free marketing audit gives you an overall score and the five fixes to make first, before you shop for software.
Medfy's patient CRM/inbox, and what it isn't
Medfy's patient CRM and inbox is included in the $349/month base plan. Every website form and message lands in one access-controlled place, and the AI CMO dashboard reports leads by source. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice before any patient data flows. Role-based permissions come with an audit log of who saw what. See Medfy's HIPAA safeguards for details.
What it isn't: Medfy is not a practice management system and does not replace one. It doesn't schedule appointments, chart, bill or file claims, and it doesn't record calls or send email or text campaigns. It handles the stretch before the first visit; your practice management software handles everything after.
Frequently asked questions
What is a dental CRM?
A dental CRM (customer relationship management system) tracks people who contact your practice before they become patients: website forms, chat messages and phone inquiries. It records where each lead came from, who followed up and whether they booked and attended a first visit. Once the person is in your schedule, your practice management software takes over for charting, treatment and billing.
Do I need a CRM if I have dental practice management software?
Your practice management software starts working once someone is a patient. If new-patient requests arrive through your website, chat or ads and you can't say how many were called back, booked and seen, a CRM fills that gap. Small offices with few web leads can start with a shared, secure inbox and a simple log, and add a CRM when volume or ad spend grows.
Does a dental CRM need to be HIPAA compliant?
A lead who asks about an implant consult or a toothache has shared health information, so the system holding that request is handling PHI. The vendor is then your business associate and must sign a BAA before any data flows. Look for role-based access, encryption, an audit log and a stated data location, and confirm the BAA covers the plan you are buying.
How much does a dental CRM cost?
Pricing models vary: per user, per location, by contact volume or bundled with other marketing software. Ask what the plan that includes a BAA costs, because some vendors reserve BAAs for higher tiers, and add setup, integration and text-messaging fees. Medfy's patient CRM and inbox is included in its $349/month base plan alongside the website, SEO and reporting.