Short answer: If HIPAA covers your clinic, a CRM that keeps patient information for your clinic generally counts as a business associate. HHS asks for a business associate agreement (BAA) with it before the CRM handles that information. HHS certifies no product as “HIPAA compliant”, so what you check is the BAA and what it covers. Your clinic still sets up its own safeguards, such as access by role and training for your team.
Before you read: The rules in this guide come from HHS’s pages on the Security Rule, cloud services, business associates and their contracts, and claims of HIPAA certification. We read them on November 12, 2026, along with the HIPAA pages of the CRM vendors it names. The guide ranks none of those vendors. Whether HIPAA applies, and what your CRM needs, depends on how your clinic handles health data. It is general information, not legal advice.
When a CRM is a business associate
HIPAA’s rules govern covered entities, and health care providers count among them when they transmit health information in electronic form for a covered transaction. Certain provisions also apply directly to business associates, HHS says.
HHS describes business associates as people or organizations outside a covered entity’s workforce that it engages for certain work involving the use or disclosure of PHI, or protected health information.
The examples of that work on HHS’s page include claims processing, data analysis, billing and practice management.
HHS’s cloud guidance covers online services, from mere data storage to complete software solutions. When a covered entity engages one that creates, receives, maintains or transmits ePHI (electronic PHI) for it, such as to process or store it, the provider is a business associate.
In our view, treat a CRM that receives inquiries about treatments as a service that keeps PHI for your clinic.
Whether a form on your site collects protected health information is the subject of our HIPAA compliant forms guide.
A “HIPAA compliant” label on a CRM
HHS and its Office for Civil Rights (OCR) do not certify any persons or products as “HIPAA compliant”. HHS says so on its page about misleading marketing claims.
The page adds that HHS has received reports of claims that some materials or systems are endorsed or required by HHS or OCR.
HHS’s rules describe a contract instead. A covered entity may disclose PHI to a business associate when it gets satisfactory assurances, in a contract or other written arrangement, that the information will be appropriately safeguarded. HHS calls it the business associate agreement, or BAA.
In our view, read “HIPAA compliant” on a CRM’s website as a claim to check, then ask for the BAA and the plan it covers.
What the BAA with your CRM vendor says
The BAA can’t authorize the vendor to use or further disclose PHI in a way that would violate the Privacy Rule if your clinic did it, HHS says.
The exceptions are what the vendor needs for its own proper management and administration, and data aggregation services relating to your clinic’s health care operations.
The sample provisions HHS publishes say the parties should specify whether the business associate may use PHI to de-identify it. They may also wish to set how it will de-identify the information and what it may do with the result.
The same provisions note that the parties may add a stricter timeframe for the business associate to report a potential breach. They may also say whether it will handle breach notifications for the covered entity.
Under the Security Rule, the BAA also provides that the business associate and any subcontractors will comply with the Security Rule requirements that apply. The business associate reports to the clinic any security incident it becomes aware of, and that covers breaches of unsecured PHI.
HHS’s cloud guidance adds that the Security Rule doesn’t prescribe the level of detail, frequency or format of security incident reports. The parties to the BAA may work those out.
The BAA may also set more timely reporting of breaches than the Breach Notification Rule requires. It may not otherwise override that Rule’s requirements, the guidance says.
When a clinic knows of a pattern of activity or practice that materially breaches or violates the BAA, it is required to take reasonable steps to cure or end it. If those steps fail, the clinic ends the BAA if feasible, HHS adds.
The terms HHS lists for every business associate contract are in our HIPAA compliant website guide.
In our view, before patient leads go in, read what the BAA lets the vendor do with de-identified data, and how soon it tells you about a breach.
The providers behind your CRM vendor
HHS’s page summarizing the Security Rule says the rule doesn’t require a covered entity to obtain satisfactory assurances from a business associate that is a subcontractor.
The CRM vendor obtains them instead, in a contract or other written agreement with each subcontractor that handles ePHI for it. Those agreements have to meet the same requirements as the BAA between your clinic and the vendor.
The email, texts and WhatsApp messages a CRM can send are in our guide to messaging patients under HIPAA. For reminders by text, our guide to appointment reminder texts covers the FCC rules on consent.
Your access to the data, and the day you leave
HHS answers a direct question in its FAQs: may a business associate block or terminate a covered entity’s access to the PHI it maintains for it? The answer is no.
Its example is an electronic health record (EHR) developer that activates a “kill switch” in its software to resolve a payment dispute. HHS calls blocking access that way an impermissible use of PHI.
At the end of the agreement, the business associate returns PHI as the BAA provides. Where the BAA says the PHI is returned, HHS says it goes back in a format that is reasonable in light of the agreement, to keep it accessible and usable.
OCR also notes that a covered entity is responsible for the availability of its own PHI. A clinic that agrees to BAA terms preventing this isn’t in compliance with HIPAA’s provisions on business associate contracts, OCR says.
In our view, ask before you sign how the vendor returns your data when the contract ends, and in which format.
What your clinic still sets up itself
HHS’s cloud guidance says a covered entity that engages a cloud service should understand the environment or solution it offers. That lets the covered entity conduct its own risk analysis and enter into appropriate BAAs.
HHS’s page summarizing the Security Rule covers the rule currently in effect, and it links to proposed modifications. In the summary, the safeguards cover both covered entities and business associates, which it calls regulated entities.
Consistent with the Privacy Rule’s “minimum necessary” standard, the summary says, a regulated entity authorizes access to ePHI only when it is appropriate for the user’s or recipient’s role.
Workforce members who work with ePHI need appropriate authorization, supervision and access. The summary also asks for security training for all workforce members, and sanctions against those who violate the privacy policies.
Authentication means procedures to verify that a person seeking access to ePHI is who they say they are. Audit controls record and examine activity in information systems that contain or use ePHI.
The summary also asks the regulated entity to regularly review its records to track access to ePHI and detect security incidents. It assesses the need for a new evaluation after changes to its security environment, such as new technology adopted.
Your clinic may also ask the vendor for more. The HIPAA Rules don’t expressly require a cloud vendor to provide documentation of its security practices or allow customers to audit them, HHS says.
Based on their own risk analysis, customers may still require extra assurances, such as documentation of safeguards or audits. They can ask for them in the BAA, the service level agreement or other documents.
In our view, give each person on your team their own CRM login, with access only to what their role needs.
What CRM vendors say on their own pages
HighLevel (GoHighLevel), HubSpot and Salesforce describe their HIPAA setups on pages of their own, read on November 12, 2026.
HighLevel’s help page, modified on November 10, 2026, says HighLevel offers an optional, account-wide HIPAA add-on and calls HIPAA a paid upgrade. The add-on enables encryption of ePHI, BAAs, audit logging and MFA enforcement.
Once bought, HIPAA is turned on for each sub-account that requires it, and the page says it can’t then be turned off.
HubSpot’s help article on storing sensitive data, updated on November 12, 2026, says the feature comes with its Enterprise subscriptions. To store HIPAA-covered data, an account selects the “Health/Medical Data” box and the “We are a HIPAA-covered entity or business associate” box.
The account then accepts the Sensitive Data Terms and, if applicable, the BAA. The article adds that Sensitive Data properties are unavailable in certain tools, including personalization tokens, sandboxes, chatbots and playbooks.
Salesforce’s page on its Business Associate Addendum, updated on September 30, 2026, says Salesforce offers the BAA for the services it lists as HIPAA Covered Services.
For a service to be covered, the customer and Salesforce sign a BAA that includes it. The customer also follows the BAA and the page, to the extent applicable. The page says the customer has to encrypt all PHI sent using those services and, to the extent within its control, stored in them.
In our view, check which plan, products and settings the vendor’s BAA covers, and turn on what its page asks for, before patient leads go in.
Before patient leads go in
- Your clinic has a signed BAA with the CRM vendor, and it covers the plan and tools you use.
- You read what the BAA lets the vendor do with your data, de-identification included.
- The BAA says how the vendor tells you about security incidents and breaches.
- Each person on your team has their own login and only the access their role needs.
- The CRM and every app connected to it are part of your risk analysis.
- You know how, and in which format, the vendor returns the data when the contract ends.
RememberIf HIPAA covers your clinic, a CRM that keeps patient information for your clinic generally counts as a business associate, and the BAA comes before the data. HHS certifies no product as “HIPAA compliant”. The vendor’s BAA sets its side, and your clinic still sets its own: access by role, training and the risk analysis.
With the Growth plan of our marketing automation for cosmetic surgery clinics, inquiries from your website, WhatsApp and your Meta and Google ads land in your CRM. Each gets a first reply on its own, then follow-ups, and appointments get reminders. We set up the CRM and messaging tools your clinic chooses, and your clinic pays the CRM subscription.
Questions about HIPAA and a clinic CRM
Does my clinic need a BAA from its CRM vendor?
Yes, if HIPAA covers your clinic and the CRM keeps PHI for it. HHS’s cloud guidance counts a service that stores ePHI for a covered entity as a business associate. The Security Rule summary puts the BAA in place before the vendor handles any ePHI.
Is HubSpot HIPAA compliant?
HHS certifies no product as “HIPAA compliant”. HubSpot’s help article, updated on November 12, 2026, explains how Enterprise accounts store HIPAA-covered data with its Sensitive Data feature. The account selects the HIPAA boxes, then accepts the Sensitive Data Terms and, if applicable, the BAA.
Does GoHighLevel sign a BAA?
HighLevel’s help page, modified on November 10, 2026, says its optional, account-wide HIPAA add-on enables BAAs, encryption of ePHI, audit logging and MFA enforcement. The page calls HIPAA a paid upgrade. Once bought, it is turned on for each sub-account that requires it.
Can a CRM vendor lock my clinic out of patient data?
No, HHS says. A business associate that blocks access to the PHI it maintains for a covered entity, including by terminating its access privileges, generally makes an impermissible use under the Privacy Rule. HHS’s example is a “kill switch” used to resolve a payment dispute.
Can my clinic audit the security of its CRM vendor?
HHS says the HIPAA Rules don’t expressly require a cloud vendor to provide documentation of its security practices or allow customer audits. Based on its own risk analysis, your clinic may still require those assurances through the BAA, the service level agreement or other documents.
Sources
Read on November 12, 2026: HHS.gov, the site of the United States Department of Health and Human Services, and the vendors’ own pages. On business associates and their contracts: Business Associates Frequently Asked Questions (FAQs), Business Associate Contracts and the FAQ on whether a business associate may block or terminate access. On security and cloud services: Summary of the HIPAA Security Rule and Guidance on HIPAA & Cloud Computing. On product claims: What You Should Know About OCR HIPAA Privacy Rule Guidance Materials. From the CRM vendors: HIPAA Compliance With HighLevel, Store Sensitive Data in HubSpot and Business Associate Addendum Restrictions from Salesforce.