HIPAA compliant CRM: how to choose one for a small practice

What makes a CRM HIPAA compliant

Three things together:

1. A BAA that covers your use. The right product, the right plan, the right features.
2. Safeguards in the product: encryption, individual logins and roles, audit logs.
3. Your configuration and policies: who gets access, what goes into which field, which integrations are allowed.

Vendors say this themselves. HighLevel's page says its platform "is not HIPAA compliant by default" and that the customer is "ultimately responsible for meeting all HIPAA requirements" (HighLevel (opens in a new tab)). Salesforce requires customers to "encrypt all PHI" sent through its services and, where within their control, stored in them (Salesforce (opens in a new tab)).

What good looks like

Illustrative example: a fictional three-provider physical therapy clinic, Riverbend PT.

• Website forms and chat post straight into the CRM; no submission is emailed in full to anyone.
• Two front-desk staff have their own logins with an "intake" role: they see and update inquiries, but can't export.
• The office manager is the only admin and reviews the access log on the first Monday of each month.
• The outside marketing contractor gets a monthly report of inquiries by source, with no names.
• The signed BAA sits in the vendor file with the plan name written on it, and the renewal date is on the calendar.

None of that requires an expensive CRM. It requires a BAA that covers the plan, and someone who owns the setup.

BAA availability: the first filter

Start every evaluation with four questions, answered in writing:

• Will you sign a BAA, and is it yours or ours?
• Which products and plans does it cover?
• Which features are excluded from coverage?
• Does it cost extra, or require a higher tier?

A "no" to the first question ends the evaluation for any CRM that will hold patient data. The answers to the other three explain most of the price differences between options.

Security features to verify: encryption, roles and audit logs

The Security Rule's technical safeguards in 45 CFR 164.312 (opens in a new tab) become an evaluation checklist:

• Unique logins for every user (required by the rule), with multi-factor authentication available.
• Roles and field-level permissions, so a marketing contractor can see campaign numbers but not patient messages.
• Encryption at rest and in transit. Encryption is addressable in the rule; for patient inquiries, expect it.
• Audit logs that "record and examine activity": who viewed, exported or changed a record.
• Automatic logoff after inactivity.
• Export and deletion, so you can leave with your data and have the rest destroyed.

Some vendors put these behind add-ons. Salesforce Shield, which includes Platform Encryption, Event Monitoring and Field Audit Trail, is "a paid add-on bundle" (Salesforce Shield (opens in a new tab)); Salesforce's BAA page lists Shield as a covered service but doesn't make it a general prerequisite.

HIPAA compliant CRM options for small practices

Every cell below comes from the vendor's official pages, checked October 23, 2026. No ratings: the right choice depends on your size and what you need the CRM to do.

Our dated checks go deeper: the Salesforce HIPAA check, Zoho HIPAA check, HubSpot HIPAA check and GoHighLevel HIPAA check.

What drives the cost

• Per-user pricing. Salesforce lists Sales Cloud from $25 to $550 per user per month depending on edition, and Health Cloud from $350 per user per month billed annually, (Sales Cloud pricing (opens in a new tab); Health Cloud (opens in a new tab)). Salesforce says its prices are for information only and subject to change. Confirm which editions your BAA covers.
• HIPAA tiers and add-ons. HighLevel's add-on is US$297/month on top of the agency plan; HubSpot limits sensitive data to Enterprise tiers.
• Security add-ons such as encryption and event monitoring.
• Setup help. Large platforms often need a consultant to configure roles and fields correctly.

Where Medfy fits

Medfy isn't a full CRM. Its base plan, $349/month (Medfy pricing), includes a patient CRM and inbox: every form and message from your Medfy website in one place, access-controlled. Patient information is stored in separate, encrypted HIPAA databases in the US or Canada; Medfy signs a BAA with each practice; first-party analytics shows calls, forms, bookings and directions by channel. It doesn't send email campaigns, run automations or sync with your EHR. See how Medfy handles patient data.

Marketing with CRM data: when authorization is needed

A CRM makes it easy to market to everyone in it. HIPAA draws a line. "Marketing" means a communication about a product or service that encourages recipients "to purchase or use" it (45 CFR 164.501 (opens in a new tab)). Using or disclosing PHI for marketing requires the patient's written authorization (45 CFR 164.508(a)(3) (opens in a new tab)), except for face-to-face communications and promotional gifts of nominal value.

The definition excludes some communications, such as describing your own health-related services or recommending treatment alternatives, unless a third party pays you to make them. Illustrative examples:

• Usually fine without authorization: an email to existing patients about a new treatment your own practice now offers, when no third party pays you to send it.
• Needs authorization: promoting a supplement brand that pays you, or uploading patients' emails to an ad platform for targeting.

Read when marketing needs authorization before building any campaign from CRM data.

Setup mistakes that create HIPAA risk

Red flags to catch before they become incidents:

• Importing patients before the BAA is in place, or on a plan the BAA doesn't cover.
• Using excluded features with PHI. HubSpot's chatbots and personalization tokens don't support sensitive data; Salesforce bars PHI from Einstein Bots utterance records.
• Forgetting per-account switches. HighLevel's HIPAA setting must be turned on for each sub-account.
• Shared logins at the front desk, which make the audit log useless.
• Notification emails that copy patient messages into personal inboxes.
• Unvetted integrations. Salesforce says customers are responsible for the HIPAA compliance of third-party LLM providers used with its Einstein GPT services.
• Downgrading. HubSpot says that after a downgrade from Enterprise, you can't create new sensitive data properties.

To see which tools on your current website already collect patient data, run the free marketing audit.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Which CRMs will sign a BAA?

Of those we checked in October 2026: Salesforce for its listed HIPAA covered services, HubSpot on Enterprise subscriptions with Sensitive Data turned on, HighLevel with its paid HIPAA add-on, and Microsoft for Dynamics 365. Zoho offers a BAA template on request. Each limits coverage to certain products, plans or features, so confirm your exact plan in writing and have your compliance officer review the agreement.

Is HubSpot a HIPAA compliant CRM?

No CRM is compliant on its own. As of October 2026, HubSpot can hold PHI on Enterprise subscriptions with its Sensitive Data setting on and the BAA accepted during setup. The BAA covers only features HubSpot lists as covered, and tools such as chatbots, personalization tokens, playbooks and sandboxes don't support sensitive data. Read our HubSpot check and confirm with your compliance officer.

What is the best HIPAA compliant CRM for a small practice?

The one that signs a BAA for a plan you can afford, covers the features you'll actually use with patient data, and that your front desk will keep current. If your main need is capturing website inquiries, a patient inbox tied to the website may be enough. If you need campaigns or complex pipelines, compare BAA scope and add-on costs. Confirm the choice with your compliance officer.