A CRM for therapists does one job your EHR wasn't built for: keeping track of everyone who asked about therapy but isn't a client yet. Voicemails, website forms, directory messages and physician referrals arrive in different places, and the ones that slip through are people who needed help and found someone else. This guide defines that job from first inquiry to intake, lists the HIPAA must-haves and shows how an inquiry CRM sits next to your EHR rather than replacing it.
About 260 people a month search "crm for therapists" in the US, and advertisers pay about $48.63 per click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026). The results mix sales software, EHRs and practice-management suites, which is why the categories below matter.
CRM, EHR or practice management: what each is for
These tools overlap, but each has a center of gravity.
| Tool | Built for | Typical contents | Who is in it |
|---|---|---|---|
| Inquiry CRM | Getting from first contact to first session | Source, contact details, reply status, consult outcome | Prospective clients, including those who never book |
| EHR (electronic health record) | The clinical record | Intake forms, assessments, progress notes, treatment plans | Clients in care |
| Practice management | Running the business | Scheduling, billing, insurance claims, payments | Clients in care |
| Sales CRM (general business) | Sales pipelines for any industry | Deals, email campaigns, ad audiences | Anyone, often without a BAA or HIPAA settings by default |
The handoff point is intake. Once someone books a first session, the EHR becomes their record. The CRM keeps what happened before that: where they came from, how fast you replied and why the ones who didn't book went elsewhere.
General sales CRMs are the trap. Many include features that sync contacts to ad platforms and email tools, which is the opposite of what a therapy inquiry needs.
The inquiry-to-intake path a CRM should cover
Map your own path first, then judge software against it. A typical private practice has six stages:
- Inquiry arrives. Website form, directory message, voicemail, email or a referral from a physician or EAP.
- First reply. A short, non-clinical response offering consult times.
- Consult scheduled. Usually a free 10 to 20 minute phone or video call.
- Consult held. You decide together whether it's a fit.
- Outcome. Booked for intake, referred out (fee, insurance, specialty or waitlist), or no response.
- Handoff. Intake paperwork and the clinical record move to your EHR.
What good looks like: every inquiry lands in one list, whatever the channel; each has an owner and a status; nobody waits more than a business day for a first reply; and the referred-out list doubles as your referral network, because the colleagues you send people to often send people back.
Illustrative example (fictional group practice): Northside Family Therapy has three clinicians and a part-time intake coordinator. The coordinator sees every new inquiry and its source, but not clinical notes. Each clinician sees inquiries assigned to them. The owner sees all of it, plus a monthly report of inquiries by source and how many became clients.
Before choosing software, check the front of the path. A free marketing audit scores your website, Google listing and other channels and flags privacy risks such as ad pixels on patient forms.
HIPAA must-haves: BAA, access control and audit log
An inquiry that says "I'm looking for help with panic attacks" plus a name and phone number is health information that identifies a person (45 CFR 160.103 (opens in a new tab)). Treat your CRM the way you treat your EHR. For the full vendor checklist, see what makes a CRM HIPAA compliant; for the wider picture, our guide to HIPAA for therapists.
Evaluation checklist
- Signed BAA before any inquiry is entered. A vendor that stores protected health information for you is a business associate, and HIPAA requires the arrangement to be documented in a written agreement (45 CFR 164.502(e) (opens in a new tab)).
- Unique logins and role-based access. The Security Rule's access control standard calls for unique user identification and access only for people granted it (45 CFR 164.312 (opens in a new tab)). No shared intake logins.
- Audit log. The same section requires audit controls that record and examine activity in systems holding electronic PHI. You should be able to see who opened a record.
- Encryption in transit and at rest, plus automatic logoff on idle sessions. Encryption and automatic logoff both appear in 164.312.
- No ad-platform syncing. Inquiry lists should never become custom audiences.
- Export. You can take your data with you.
Minimum-necessary inquiry forms
HIPAA's minimum necessary standard asks you to limit the PHI you use, disclose or request to what the purpose requires (45 CFR 164.502(b) (opens in a new tab)). Design the form the same way. Ask for name, preferred contact method, availability, insurance or self-pay, and an optional "anything you'd like us to know" box with a note to keep it brief. Leave detailed symptom history for the consult or intake.
Red flags
- "HIPAA-ready" or "HIPAA-friendly" marketing with no BAA on offer, or a BAA only on a plan you don't have.
- Contact syncing to Facebook, Google or email tools switched on by default.
- Inquiries forwarded to personal email or exported to spreadsheets that travel.
- One login shared by the whole front desk.
Cost drivers
Ask how the price scales: per user, per contact, per feature tier or per location. Ask whether the BAA requires a specific plan, what integrations cost, and whether texting or email features add fees.
Speed to reply: why it decides who gets the client
Someone looking for a therapist may message three directory profiles, leave a voicemail at a fourth and fill in a website form at a fifth, often late at night after finally deciding to act. The first clear, warm reply that offers a time has an advantage, because it removes the next decision.
What helps:
- One inbox for every channel, so nothing waits in a forgotten directory account.
- A same-business-day rule, with a named person covering vacations.
- A short reply template that offers two consult times and states your fee or insurance status.
- An automatic acknowledgment for after-hours forms that gives your usual reply time and lists the 988 Lifeline (opens in a new tab) for anyone in crisis.
The general case for fast replies across specialties is in our guide to speed to lead. For therapy the stakes are higher: the person who waits may not reach out again soon.
What to track: sources, response time and consult outcomes
Five numbers tell you most of what you need. Review them monthly.
| Metric | Why it matters |
|---|---|
| Inquiries by source | Shows which directory, referrer or page is worth your time and money |
| Time to first reply | The one number you fully control |
| Consult rate | Inquiries that turn into a consult call; low rates suggest slow replies or unclear fees |
| Conversion to first session | Consults that book intake; low rates suggest a fit or pricing problem |
| Reasons for referring out | Tells you whether to adjust fees, join a panel or recruit a clinician |
Add one question to every consult: "How did you hear about us?" Software attribution can't see word of mouth. When the numbers point to a weak channel, our guide to getting more therapy clients covers the fixes, and the broader patient CRM guide compares vendor categories across specialties.
Where Medfy's patient CRM and inbox fit
Medfy is AI marketing software for independent practices, not an EHR, and it doesn't do scheduling, billing, insurance claims, or email or text campaigns. Its patient CRM and inbox cover the inquiry side:
- Every form and message in one place, access-controlled, including new-patient requests captured by the optional HIPAA AI chat widget ($49/month).
- Role-based permissions with an audit log of who saw what.
- Separate, encrypted HIPAA databases in the US or Canada, encrypted in transit and at rest.
- A BAA signed with your practice before any patient data flows.
- Leads by source in the AI CMO dashboard, with first-party analytics for calls, forms, booking clicks to your own scheduling tool, directions and visits from AI assistants.
- Ad platforms never receive patient data; marketing uses aggregate numbers only.
Phone calls and voicemails stay with your phone system: Medfy doesn't answer phones, record calls or provide tracking numbers. The CRM comes with the $349/month base plan, which also includes your website rebuilt and hosted on your domain, automated SEO and AI visibility tracking. See plans and pricing. For the rest of the funnel, see the overview of marketing for therapists.
Frequently asked questions
Do therapists need a CRM if they have an EHR?
Not always. An EHR is built around the clinical record of people in care, while inquiries that never book still need a home. With a handful of inquiries a month, a careful process in a HIPAA-covered tool may be enough. Once requests arrive from several directories, your website and referrers, a CRM shows who is waiting, where they came from and what happened to each one.
What makes a CRM HIPAA compliant?
No software is compliant on its own; what matters is the vendor's written commitment and how you use the tool. Look for a signed business associate agreement, unique logins with role-based access, an audit log of who viewed or changed records, encryption in transit and at rest, and no syncing of inquiry data to ad platforms. Then collect only the information you need.
How fast should a therapist reply to a new inquiry?
As fast as you reliably can, ideally the same business day. People looking for a therapist often message more than one, and a prompt, clear reply offering two consult times makes yours the easy one to accept. If you can't reply quickly, send an automatic acknowledgment that states your usual reply time and lists 988 for anyone in crisis.