What does HIPAA mean for a CRM?
A CRM handling health information needs a signed Business Associate Agreement and the required safeguards. The software alone is never HIPAA compliant.
Want to see it first? Book a demo
HIPAA and CRMs — HIPAA, applied to a CRM, means the system that stores protected health information is covered by a Business Associate Agreement with the vendor and configured with the required safeguards: access control, audit, encryption, retention. No CRM is "HIPAA compliant" by itself. The arrangement is.
Why it matters
HIPAA governs protected health information. When your CRM stores or handles that kind of data, the law's rules attach to the deal between you and the vendor, not to the software on its own. You need a Business Associate Agreement in place: a set contract between the covered entity and the vendor. The system also has to be set up with the safeguards HIPAA asks for. That means access control over who can see records, and audit logs of who opened what. It means data encrypted at rest and in transit. And it means clear rules on how long you keep records.
So the phrase "HIPAA compliant CRM" misleads on its own. Software doesn't carry compliance by itself. One customer can use a tool with a signed BAA and the right setup, and be covered. Another can use the same tool, never sign a BAA, never turn on the controls, and not be. People often treat a field as safe for patient details because it's "just a name". But a name paired with any visit or treatment detail is protected health information under the law.
What a HIPAA-covered CRM arrangement requires
- 1
Confirm a Business Associate Agreement exists
A signed BAA between the covered entity and the vendor must be in place before you store any PHI.
- 2
Configure access control
Limit which users can view or change records that hold health information.
- 3
Enable audit logging
Track who accessed which records and when.
- 4
Apply encryption
Data must be encrypted both at rest and in transit.
- 5
Define retention practices
Set and follow rules for how long records are kept and how they're deleted.
The mistake to watch for
Questions
- How is HIPAA compliance different from a BAA?
- A Business Associate Agreement is the contract that sets out what the vendor owes under HIPAA for one setup. Compliance is the wider result. It means that contract is signed, and the needed technical and admin safeguards are set up and followed.
- Is any CRM 'HIPAA compliant' out of the box?
- No. Compliance describes the deal between the covered entity and the vendor, with a signed BAA and safeguards set up right. Software doesn't have it apart from how it's set up and used.
- What counts as protected health information in a CRM?
- Any detail that names a person, paired with a health or visit detail such as a treatment, generally counts as protected health information. That covers more than data labeled as medical.