A HIPAA-compliant CRM is a customer relationship management system that a behavioral health practice can lawfully use to store and process protected health information, which requires both a signed business associate agreement with the vendor and a configuration that meets the HIPAA Security Rule. No CRM is compliant on its own. Compliance is a property of the agreement and the setup, not of the software.
What makes a CRM compliant?
Four things have to be true at once.
The vendor will sign a business associate agreement. Without one, transmitting protected health information to that vendor is a disclosure the practice is not authorized to make.
The product tier in use is covered by that agreement. Several vendors sign agreements only for specific editions or only after a compliance module is purchased, which means a practice on a lower tier can be using the same brand of software and have no coverage at all.
The technical safeguards are in place. Encryption at rest and in transit, role-based access control, audit logging, and session controls.
The practice has configured the system to match. Permissions actually restricted, audit logs actually reviewed, and integrations checked for whether they carry data outside the covered environment.
Does a compliant CRM mean the practice is compliant?
No. The agreement moves a defined set of obligations onto the vendor. Everything on the practice’s side of the line stays there, including workforce training, access management, minimum necessary use, and breach notification procedures.
A practice using a covered product incorrectly is not protected by the agreement it signed.
What about marketing data specifically?
This is where most behavioral health practices get into difficulty, because the inquiry stage sits in an unclear zone. A name and phone number submitted through a contact form is not automatically protected health information. The same submission attached to a specific service line, a stated presenting concern, or an appointment request carries considerably more risk.
The regulatory picture here has moved recently. In June 2024, a federal court vacated the portion of HHS guidance that treated an IP address combined with a visit to an unauthenticated webpage as individually identifiable health information. HHS filed an appeal and then withdrew it. The remainder of that guidance still applies, and HIPAA continues to apply whenever identifiable information is collected alongside information about a person’s condition, care, or payment for care. Separately, private litigation over website tracking technologies has continued under state wiretap and privacy statutes, which the federal ruling did not address.
The practical conclusion for a practice is to treat inquiry data as sensitive by default, keep it inside systems covered by an agreement, and decide deliberately what leaves.
Where should a practice start?
By asking a prospective vendor two questions in writing. Will you sign a business associate agreement, and which plan or module does it cover.
A vendor that cannot answer both clearly is not a candidate. More on what the system needs to do once it is in place is in What Should a Behavioral Health CRM Actually Do?
This article is general information and is not legal advice. Practices should have their own counsel review vendor agreements.
