Healthcare CRM: what a medical practice actually needs

What a healthcare CRM does for a practice

For an independent practice, a CRM does four jobs:

1. Capture. Every website form, chat conversation, and message lands in one list instead of three inboxes and a voicemail box.
2. Route. Each inquiry gets an owner, usually the front desk, with a status: new, contacted, booked, not a fit.
3. Follow up. Staff can see who hasn't heard back and what was said last.
4. Attribute. Each inquiry carries its source, so you know whether Google Ads, your Business Profile or a referral produced it.

That's the core. Enterprise features such as care-plan management, payer modules and marketing automation suites solve hospital problems. If you're weighing tools, HIPAA compliant CRM options compares them with BAA availability as the first filter.

CRM vs EHR vs practice management system

The overlap causes confusion. Practice management systems often handle reminders and recalls, and some EHRs include a portal for messages. A CRM earns its place by covering the part before someone becomes a patient, plus the question of where patients come from. Dental practices face the same split with their own systems; see dental CRM.

Must-have features for a small practice

A short list, in order of importance:

• A BAA from the vendor for the plan you'll buy. Without it, nothing else matters.
• One inbox for every channel your website uses: forms, chat and messages.
• Owner and status on every inquiry, so nothing sits unanswered.
• Source on every inquiry: ad campaign, organic search, Business Profile, referral.
• Role-based access, so a marketing contractor never sees patient messages.
• An audit log of who viewed and changed each record.
• Simple export, so you can leave without losing history.

Nice to have, not essential: pipelines with many stages, lead scoring, built-in email campaigns. Each extra feature that touches patient data is another thing the BAA must cover.

HIPAA requirements for a CRM: BAA, access and audit logs

A CRM holding inquiries from patients holds protected health information: a name tied to a reason for visit, in your practice's hands, is individually identifiable health information (45 CFR 160.103 (opens in a new tab)). Three requirements follow.

A BAA. The vendor stores PHI for you, so it's a business associate and you need its written assurances before data flows (45 CFR 164.502(e) (opens in a new tab)).

Access control. The Security Rule requires technical policies that allow access only to people with granted rights, with a unique user ID for each person (required) and encryption as an addressable specification (45 CFR 164.312(a) (opens in a new tab)). In a CRM that means individual logins and roles, not one shared front-desk account.

Audit controls. The same section requires mechanisms that "record and examine activity" in systems containing electronic PHI (164.312(b)). Your practice also has to review those records regularly; information system activity review is a required specification (45 CFR 164.308(a)(1)(ii)(D) (opens in a new tab)).

A BAA doesn't configure anything. Who gets which role, when access is removed, and how often someone reads the logs are your practice's decisions.

Connecting your website, forms and chat to the CRM

The weak points are the connections, not the CRM itself. Check each path patient data takes on its way in:

• Website forms → CRM. Does the form tool post directly into the CRM, or email the submission first? An email hop adds the email provider to your BAA list.
• Chat → CRM. Does the chat vendor store transcripts on its side too? Then it needs its own BAA.
• Integration tools. Connector services that pass data between apps handle PHI in transit and need BAAs as well.
• Tracking on the form page. Ad pixels on the page where patients submit details can send data to ad platforms, outside any BAA.

The fewer hops, the fewer contracts and the fewer places for data to leak.

Seeing which marketing brings patients

Attribution is where a CRM pays for itself. With the source on every inquiry, you can count new-patient requests by channel each month and compare them with what each channel costs. That turns "we think Google Ads works" into a number. Our guide to patient acquisition strategies covers which channels to test.

There's a HIPAA line here. Counting inquiries by source is fine. Using patient information from the CRM to market to those patients, such as uploading their emails to an ad platform or promoting a third party's product, can require written authorization. HIPAA defines marketing as a communication that encourages people "to purchase or use" a product or service (45 CFR 164.501 (opens in a new tab)), with exceptions for some treatment and operations communications. Outside those, it requires authorization (45 CFR 164.508(a)(3) (opens in a new tab)). See HIPAA authorization for marketing before you build a campaign from CRM data.

Popular CRMs and their HIPAA status

Vendor terms change, so each check below is dated and sourced from the vendor's own pages. We don't restate verdicts here; read the check for the plan you're considering.

• Is Salesforce HIPAA compliant: which Salesforce services its BAA covers, Health Cloud versus Sales Cloud, and whether it's practical at small-practice size.
• Is Zoho HIPAA compliant: Zoho's BAA, and why CRM, Forms, Mail and Bookings need separate checks.
• Is HubSpot HIPAA compliant: the subscription tier and settings involved, and the tools that can't hold sensitive data.
• Is GoHighLevel HIPAA compliant: the agency platform's HIPAA option and what the agency has to switch on.

Where Medfy's patient CRM fits

Medfy's patient CRM is a patient inbox, not an enterprise CRM. It's included in the $349/month base plan (Medfy pricing) and does one job: every form and message from your Medfy website in one place, access-controlled.

• Patient information is stored in separate, encrypted HIPAA databases in the US or Canada.
• Medfy signs a BAA with each practice before any patient data flows.
• Role-based permissions come with an audit log of who saw what.
• First-party analytics shows calls, forms, bookings and directions by channel, so you can see which marketing produces inquiries.
• Ad platforms never receive patient data.

What it doesn't do: it doesn't send email or SMS campaigns, run marketing automations, schedule appointments or sync with your EHR. If you need those, you'll pair it with other tools or choose a full CRM. More on safeguards: how Medfy protects patient data. To see how your current site handles inquiries, start with the free marketing audit.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What is a healthcare CRM?

A healthcare CRM is software that tracks people who contact your practice before and between visits: inquiries from forms, chat and calls, who followed up, and which marketing channel brought them in. It sits beside your EHR, which holds the clinical record. In a small practice its main job is making sure no new-patient request is missed and that you can see where patients come from.

Does a small medical practice need a CRM?

It needs what a CRM does: one place where every inquiry lands, an owner for each one, and a record of the source. A small practice can get there without enterprise software, for example with a patient inbox tied to its website forms and chat. If requests now arrive by email, voicemail and social messages with nobody tracking them, you'll feel the gap in missed new patients.

Is a CRM covered by HIPAA?

When it holds patient information for your practice, yes. Names linked to a reason for visit or appointment request are PHI in your hands, so the CRM vendor is a business associate and must sign a BAA, and the system needs access controls and audit logs. A CRM used only for non-patient contacts, such as vendors or referral partners, is different. Confirm your setup with your compliance officer.

What is the difference between a CRM and an EHR?

An EHR is the clinical record: diagnoses, notes, medications and results, used to treat patients. A CRM manages the relationship around care: inquiries, follow-ups and where each patient came from. The EHR is built for clinicians; the CRM for the front desk and whoever runs marketing. Many practices also run a practice management system for scheduling and billing, which overlaps with both.

Can I use a regular CRM for patient information?

Only if the vendor signs a BAA covering the plan and features you use, and you configure it properly. Several mainstream CRMs we checked limit HIPAA use to certain tiers or add-ons and exclude some features. Without a BAA, keep patient information out entirely. Check our dated vendor reviews before you import a single record, and confirm the decision with your compliance officer.