A search for a HIPAA compliant CRM should lead to questions about your actual workflow: what information enters the system, who can access it, where it travels, and which parties take responsibility. A product label cannot answer those questions. HHS permits cloud use for electronic protected health information only with the appropriate business associate agreement and compliance with the applicable HIPAA Rules. HHS cloud guidance, question 1.
SMBcrm offers HIPAA-compliant service for eligible organizations, subject to additional fees and an annual commitment. Contact us to confirm eligibility before entering, importing, syncing, or messaging protected health information (PHI). Confirm the applicable agreement, configuration, and approved workflows with our team before processing PHI; a standard subscription alone does not establish eligibility.
This is an educational purchasing guide, not legal advice or a complete compliance assessment. Sources were checked September 14, 2026. HHS’s Security Rule summary identifies the requirements currently in effect and separately links proposed changes; proposals should not be treated as current obligations.
Establish who you are and what the CRM would hold
A covered entity includes a health plan, healthcare clearinghouse, or healthcare provider that electronically transmits health information in connection with HIPAA-standard transactions. Using email alone does not make a provider a covered entity. A small clinic or wellness business should determine its status from its activities, including transactions performed through billing providers. HHS Privacy Rule summary: who is covered.
A business associate performs qualifying functions or services involving PHI for a covered entity; subcontractors handling PHI for a business associate can also fall within that definition. An ordinary vendor whose service does not involve PHI is not automatically a business associate just because its customer is a clinic. Assess the relationship and data involved. HHS business associate guidance.
PHI includes individually identifiable information about health, care, or payment held or transmitted by a covered entity or its business associate, subject to defined exclusions. It can be electronic, paper, or oral. Consequently, a contact record linked to a treatment request needs review even without a diagnosis field. Calling a record a “lead” does not settle its classification. HHS Privacy Rule summary: protected information.
Understand what a BAA and a security badge establish
A business associate agreement (BAA) documents permitted uses and disclosures, safeguards, reporting duties, and other required terms. It also addresses subcontractors and returning or destroying PHI at termination where feasible. A standard subscription agreement or privacy policy should not be assumed to contain the required provisions. HHS business associate contract guidance.
Signing a BAA does not configure permissions, train employees, or validate an integration. HHS explains that both the cloud provider and customer retain applicable responsibilities. A provider storing encrypted PHI can still be a business associate without the decryption key, and qualifying providers have obligations even without an executed BAA. HHS cloud guidance, questions 1, 2, and 5.
There is no government HIPAA certification badge that approves your CRM deployment. HHS does not recognize private Security Rule certifications as relieving legal obligations or preventing a later violation finding. Ask what an assessment examined, its scope, and what remains your responsibility. HHS certification FAQ.
SMBcrm’s security and compliance page describes ISO 27001 and security controls. Those statements do not establish HIPAA suitability. Strong security features can exist in a CRM that remains unsuitable for PHI; SMBcrm’s eligibility review and additional requirements above still apply.
Evaluate safeguards in everyday work
HIPAA’s Security Rule addresses administrative, physical, and technical safeguards for electronic PHI. The following questions translate those categories into a CRM evaluation; they are not an exhaustive legal checklist. HHS Security Rule summary.
Administrative safeguards include risk analysis, risk management, workforce training, activity review, incident procedures, and contingency planning. Your assessment must address risks and vulnerabilities to your electronic PHI. A vendor’s security report cannot describe every configuration your staff will use. Ask who owns the assessment, unresolved findings, employee access changes, and recovery procedures. 45 CFR 164.308.
Physical safeguards cover facilities, workstations, devices, and media. For a small practice, the evaluation should include reception computers, downloaded exports, mobile devices, and equipment disposal alongside the vendor’s hosting environment. HHS Security Rule summary: physical safeguards.
Technical safeguards include access control, audit controls, integrity protections, authentication, and transmission security. Ask for a demonstration using synthetic records: a receptionist’s access, an administrator’s permissions, and the activity records available after an export. Ask about unique user identification, emergency access, encryption, and how logs can be examined. These safeguards and implementation specifications appear in 45 CFR 164.312.
The Privacy Rule generally requires reasonable steps to limit PHI to the minimum necessary for the purpose. Exceptions include disclosures to, or requests by, healthcare providers for treatment. Avoid treating that exception as blanket permission for every marketing workflow. Document which roles need which information and why. HHS minimum-necessary guidance.
Map one PHI data flow before choosing software
Use a fictional patient and synthetic details for this exercise. Do not upload real records to a sales demo. This is a practical planning exercise supporting risk analysis, not proof that a deployment meets HIPAA requirements. HHS risk-analysis context.
Choose a workflow such as a consultation request. Draw every step from the first form through follow-up and eventual deletion. Then complete this worksheet with your privacy and security reviewers:
| Step | Questions to answer |
|---|---|
| Collection | Which fields, free-text answers, attachments, and page details enter the form? Could they identify someone seeking care? |
| Storage | Where do contact records, notes, recordings, transcripts, backups, and logs live? |
| Access | Which employees, support teams, contractors, and service accounts can retrieve them? |
| Transfer | What reaches email, SMS, calendars, automation connectors, analytics, or AI tools? |
| Replies | Can a recipient send health details or images back into the system? Where would those replies go? |
| Exit | What is exported, retained, deleted, or left in backups when the relationship ends? |
For each transfer, write down the recipient, purpose, fields, contract coverage, permissions, and person responsible for approval. Treat an unknown destination as an unresolved evaluation item. Repeat the exercise for failure paths, such as a misdirected notification or staff member downloading a spreadsheet to a personal device.
Ask vendors for evidence you can inspect
Use the data-flow worksheet during vendor meetings. These are purchasing questions, not a list of features that independently establishes compliance:
- Which exact services and optional modules does your proposed BAA cover? Which integrations are excluded?
- Which subcontractors would handle our data, and how do you communicate changes?
- Can you demonstrate role permissions, authentication settings, access removal, and audit-log retrieval with synthetic records?
- What responsibilities belong to us for configuration, training, backups, and recovery testing?
- How are incidents escalated, and what evidence will we receive for our investigation?
- What happens to active records, attachments, logs, and backups at termination?
- How would the service support applicable access, amendment, and accounting obligations?
Have counsel compare the answers with the contract. HHS’s BAA guidance addresses safeguards, reporting, subcontractor restrictions, individual-rights support, and termination. A screenshot of a security setting cannot establish the scope of those commitments.
Plan retention, deletion, and incident response
Do not adopt a blanket “HIPAA requires six years of patient records” policy. HHS says the Privacy Rule does not set medical-record retention periods; state laws generally do. Required Security Rule documentation has a separate six-year retention rule measured from creation or when last in effect, whichever is later. HHS medical-record retention FAQ; 45 CFR 164.316(b).
Ask your reviewers to define retention by record type and reconcile it with deletion, backup, and export capabilities. Ask vendors how they handle PHI that cannot feasibly be returned or destroyed at termination; the BAA must address continuing protections in that situation. HHS contract guidance.
Establish who receives incident reports, preserves evidence, contains exposure, and coordinates the assessment. An impermissible PHI use or disclosure is generally presumed a breach unless an applicable exception or a documented assessment supports a low probability of compromise. Notification duties depend on the circumstances; business associates notify covered entities, and covered entities have individual, HHS, and sometimes media obligations. Use the HHS Breach Notification Rule guidance with qualified reviewers rather than assuming every incident has the same notification process.
Confirm your organization’s eligibility with SMBcrm
SMBcrm’s HIPAA-compliant service requires additional fees and an annual commitment. Contact our team to confirm your organization’s eligibility, pricing, agreement requirements, and which workflows can be supported before using the service for PHI.
Our healthcare and dental pages describe patient-facing workflows, but those descriptions do not establish eligibility for your account. Review the Trust Center and legal terms alongside the terms confirmed for your organization. Do not assume every feature or integration is approved for PHI.
Have qualified privacy/legal reviewers evaluate the complete data flow before configuring CRM tools or communication features. For work outside an approved PHI workflow, consider only non-PHI uses, such as business-partner outreach or general public-event promotion using independently collected contacts, after that review. Do not assume patient lists, appointment inquiries, or replies qualify as non-PHI.
Review plans and the 60-day guarantee
Eligible new Startup and Professional subscriptions include a 60-day money-back guarantee on the initial base subscription fee, subject to the legal terms and exclusions; usage, add-ons, and third-party charges are excluded. Contact us to confirm the fees, annual commitment, and any applicable refund terms for HIPAA-compliant service; do not assume the standard guarantee covers those additional arrangements.
