CRM and marketing automation for medical practices: what patient data can go in, and the rules that follow it

A practice buys a CRM or a marketing automation tool to keep track of leads, send appointment reminders, run recall campaigns and see which ads bring in patients. The setup screen then asks for a contact list, custom fields and a sync with the practice management system. Each of those choices decides what patient information ends up in a vendor’s system, and which rules come with it.

This guide covers the data question: what can go into a CRM, who the vendor is under HIPAA, which messages count as marketing, and how opt-outs and access requests reach the tool. The rules for the emails themselves are in our healthcare email marketing guide, the contract with an outside firm is covered in marketing agencies and BAAs, and consent for texts is in our business texting rules guide. Setting up the sending domain a CRM mails from is covered in our guide to email authentication for practices. For messages after a patient dies, see patient death communications and HIPAA.

The short version

• A tool that creates, receives, maintains or transmits protected health information for your practice is a business associate under 45 CFR 160.103, and you need a business associate agreement that meets 45 CFR 164.504(e) before patient information goes in (45 CFR 164.502(e)).
• Messages about your own services, reminders and care coordination fall outside HIPAA’s definition of marketing unless a third party pays you to send them (45 CFR 164.501). Paid messages, and messages about another company’s products, need the patient’s written authorization (45 CFR 164.508(a)(3)).
• Minimum necessary applies to uses inside your practice, not only disclosures (45 CFR 164.502(b)). Put in the CRM only the fields each campaign needs, and limit which staff see clinical fields (45 CFR 164.514(d)(2)).
• Email unsubscribes must be honored within 10 business days (15 USC 7704(a)(4)), and text opt-outs made by any reasonable method within a reasonable time not to exceed ten business days (47 CFR 64.1200(a)(10)). Both have to reach each tool that sends.
• If the CRM holds records your practice uses to make decisions about patients, it can be part of the designated record set that patients have a right to see (45 CFR 164.501, 164.524).
• State consumer health data laws, such as Washington’s chapter 19.373 RCW, can reach website leads and other data that HIPAA does not cover.

When a CRM vendor is a business associate

HIPAA defines a business associate as a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains or transmits protected health information for a function or activity HIPAA regulates (45 CFR 160.103). The definition lists data analysis, processing or administration among its examples.

Protected health information is individually identifiable health information held or sent in any form (45 CFR 160.103). Individually identifiable health information includes demographic information collected from an individual when it is created or received by a health care provider, relates to the person’s health, care or payment for care, and identifies the person or could reasonably be used to identify them (45 CFR 160.103). Read with that definition, a patient list with appointment types, a recall list built from diagnosis codes, or a web form where a person describes symptoms to your practice can each be protected health information once your practice holds it.

A covered entity may disclose protected health information to a business associate, and let it create or receive the information on the practice’s behalf, only with satisfactory assurances in a written contract (45 CFR 164.502(e)). The Security Rule sets the same condition for electronic protected health information (45 CFR 164.308(b)(1)). A CRM or automation vendor that stores your patient contacts and visit data is in that position.

What the agreement has to cover

The contract terms are listed in 45 CFR 164.504(e)(2). Five of them matter in daily CRM use:

• Permitted uses. The contract sets what the vendor may do with the information and may not let it use the information in a way the practice could not (164.504(e)(2)(i)).
• Safeguards. The vendor uses appropriate safeguards and complies with the Security Rule for electronic information (164.504(e)(2)(ii)(B)).
• Subcontractors. The vendor’s own subcontractors that handle the information agree to the same restrictions (164.504(e)(2)(ii)(D)). For a CRM, that can include the email sending service, the texting service and the hosting provider behind it.
• Access and amendment. The vendor makes information available for patient access and amendment requests (164.504(e)(2)(ii)(E) and (F)).
• End of contract. At termination, the vendor returns or destroys the information if feasible and keeps no copies, or extends the contract’s protections to whatever it cannot return or destroy (164.504(e)(2)(ii)(J)).

A sales page that says a product supports HIPAA is not an agreement. Read which plan, which features and which connected services the signed agreement covers. Our guide to marketing agencies and BAAs goes through the contract terms in more depth.

Which messages count as marketing under HIPAA

HIPAA defines marketing as a communication about a product or service that encourages the recipient to buy or use it (45 CFR 164.501). The same definition then excludes, unless the practice receives financial remuneration for sending them:

• communications for a patient’s treatment, including case management, care coordination, and recommending alternative treatments or settings of care;
• communications that describe a health-related product or service provided by the practice itself;
• refill reminders and messages about a drug currently prescribed for the patient, where any payment is reasonably related to the cost of sending them.

A practice may use protected health information for its own treatment, payment and health care operations without authorization (45 CFR 164.506(c)(1)). Put together, a recall email about the practice’s own cleanings, a reminder to book a follow-up, or a note about a new service the practice offers is not marketing under HIPAA, as long as no outside company pays for it.

Two situations change that. If a manufacturer, lab or other third party pays the practice to send the message, it is marketing, and the practice needs a signed authorization that states the payment is involved (45 CFR 164.508(a)(3)(i) and (ii)). The same applies to messages that promote another company’s product rather than the practice’s own services. The authorization rule has two exceptions: a face-to-face communication, and a promotional gift of nominal value (164.508(a)(3)(i)(A) and (B)). Neither covers an automated email or text.

HIPAA is only one layer. A message that is not marketing under HIPAA can still be commercial email under CAN-SPAM or a telemarketing text under FCC rules, which the sections below cover.

Minimum necessary: what to put in the CRM

When a covered entity uses or discloses protected health information, it must make reasonable efforts to limit the information to the minimum necessary for the purpose (45 CFR 164.502(b)(1)). This applies to uses inside the practice, so it reaches what you sync into a CRM. The rule does not apply to disclosures to a provider for treatment, disclosures to the patient, or uses under a signed authorization, among other exceptions (164.502(b)(2)).

The practice must also identify which staff need access to protected health information, which categories they need, and limit their access to match (45 CFR 164.514(d)(2)). The Security Rule asks for technical controls that let only authorized persons or software into systems holding electronic protected health information (45 CFR 164.312(a)(1)), and for mechanisms that record and examine activity in those systems (164.312(b)).

No federal rule lists the fields a practice CRM may hold. We recommend:

• Start from the message. A cleaning recall needs a name, contact details, preferred channel and a due date. It does not need a diagnosis, a medication list or visit notes.
• Use neutral flags such as “recall due” in place of clinical terms when a campaign only needs to know who to contact.
• Keep clinical detail in the record system and do not sync free-text notes into the CRM.
• Give front desk, marketing staff and outside vendors separate roles, and turn on the tool’s activity log.
• Review the sync settings after each software update, since a new field can start flowing without anyone choosing it.

Segments built from health information

Automation tools make it easy to build a list such as “patients with condition X who have not booked in a year.” Sending that list a message about the practice’s own treatment for X falls inside the treatment and own-service exclusions in the marketing definition (45 CFR 164.501), as long as no third party pays. The segment itself is still a use of protected health information, so minimum necessary applies to the fields it pulls (164.502(b)).

Two further points follow from the rules. First, a patient may ask the practice to restrict uses of their information for treatment, payment or operations, and a practice that agrees to a restriction must keep to it (45 CFR 164.522(a)(1)). Second, a provider must accommodate reasonable requests to receive communications by other means or at other locations (164.522(b)(1)). Both have to reach the CRM, or the automation will keep sending as before. We recommend a field for “contact restrictions” that each campaign checks before it sends.

Sending a health-based segment to an ad platform is a separate question. It is a disclosure to an outside company, not a message from the practice, and our guide to uploading patient lists to ad platforms covers it.

Opt-outs: email and text

For commercial email, CAN-SPAM requires a functioning return address or other online mechanism, clearly and conspicuously displayed, that the recipient can use to opt out, and that keeps working for at least 30 days after the message is sent (15 USC 7704(a)(3)). Once a recipient opts out, the sender may not send commercial email within the scope of the request more than 10 business days after receiving it (15 USC 7704(a)(4)(A)(i)), and may not sell or transfer the address (7704(a)(4)(A)(iv)). The FTC rule bars charging a fee or asking for anything beyond the email address and opt-out preferences, or requiring more than a reply email or a visit to a single web page (16 CFR 316.5).

For texts covered by the FCC’s consent rules, a person may revoke consent by any reasonable method. A reply of “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe” is a reasonable method per se, and a reply in other words counts if a reasonable person would read it as a request to stop (47 CFR 64.1200(a)(10)). The request must be honored within a reasonable time not to exceed ten business days, and the sender may not designate an exclusive way to revoke (64.1200(a)(10)). Our business texting rules guide covers consent and the dates that apply to it.

In a CRM the risk is practical: a patient unsubscribes in the email tool, but the same address sits in a second list, a reactivation workflow or an import from the practice system. No federal rule tells a practice how to sync opt-outs. We recommend one suppression list that each sending tool reads, a record of when each request came in, and a test each quarter that an opt-out in one channel stops the matching campaigns.

Patient access and what the CRM keeps

A patient has a right to inspect and get a copy of protected health information about them in a designated record set, for as long as it is kept there (45 CFR 164.524(a)(1)). A designated record set includes medical and billing records and any other group of records used, in whole or in part, by or for the practice to make decisions about individuals (45 CFR 164.501). The practice generally has 30 days to act on a request, with one extension of up to 30 days under the conditions in 164.524(b)(2).

Whether a CRM is part of the designated record set depends on what it holds and how the practice uses it. A CRM used only to send reminders may not be. One whose notes drive scheduling or care decisions may be. Decide this with counsel, write the answer down, and make sure the vendor agreement requires the vendor to make information available for access requests (164.504(e)(2)(ii)(E)).

We found no HIPAA provision that sets a retention period for patient contact data in a marketing tool, and state law can set its own record rules. For the CRM, we recommend a written retention period for leads who never became patients and for former patients, and using the agreement’s return or destroy clause when you change vendors (164.504(e)(2)(ii)(J)). Our guide to advertising records retention covers the separate question of keeping copies of the ads themselves.

State consumer health data laws

State laws can regulate health data that HIPAA does not reach. Washington’s chapter 19.373 RCW gives consumers the right to confirm whether a regulated entity collects, shares or sells their consumer health data, and to access it, including a list of the third parties it was shared with (RCW 19.373.040(1)(a)). The chapter exempts information that is protected health information under HIPAA (RCW 19.373.100(1)(a)(i)), so its main reach for a practice is data outside HIPAA, for example from people who never become patients, depending on the facts. Nevada’s chapter 603A of the Nevada Revised Statutes also has provisions on consumer health data (NRS 603A.400 onward).

We recommend that a practice with patients or leads in those states map which CRM records fall under HIPAA and which may fall under a state law, and have counsel review consent wording on web forms before a campaign starts.

Questions to ask before you connect a CRM

• Will the vendor sign a business associate agreement, and which plan, features and connected services does it cover?
• Which subcontractors handle our data, such as email, text and hosting providers, and are they bound to the same terms?
• Which fields will sync from the practice system, and can we turn off free-text notes?
• Can we set roles so that marketing staff do not see clinical fields?
• Is there an activity log we can review?
• Does an opt-out in one channel reach each list and workflow?
• Can the tool record restriction and confidential communication requests and stop campaigns for those patients?
• Can we export one patient’s records for an access request?
• What happens to our data when the contract ends?

Use and avoid

• Use: a signed business associate agreement before any patient data syncs.
• Use: neutral campaign flags in place of diagnosis terms.
• Use: one suppression list read by each tool that sends.
• Use: separate user roles and the activity log.
• Avoid: syncing visit notes or medication lists into a marketing tool.
• Avoid: sending a third party’s paid message to patients without a signed authorization.
• Avoid: treating a vendor’s HIPAA sales page as the agreement.
• Avoid: importing an old patient list into a new workflow without checking it against past opt-outs.

An illustration

This example is invented. [Practice name], a physical therapy clinic, connects a new CRM to its scheduling system. The default sync brings in each patient’s name, contact details, referring diagnosis and the therapist’s last note. The office manager sees that the reactivation campaign only needs the name, contact details, preferred channel and the date of the last visit.

They switch off the diagnosis and note fields, set a “recall due” flag in their place, and give the front desk and the outside marketing contractor roles without clinical fields. Before turning on the sync, they get the vendor’s signed agreement and check that it covers the texting add-on they plan to use. They also add a “contact restrictions” field, after a patient asked the clinic to send messages only by mail, and set each campaign to skip patients with that field filled in.

A month later, a patient replies “no more please” to a recall text. The CRM does not treat it as a keyword, but the clinic’s process treats any reply that a reasonable person would read as a stop request as an opt-out, so staff add the number to the suppression list the same day.

Checklist

• Business associate agreement signed, covering the plan, features and subcontractors in use.
• Field map written: what syncs, why each field is needed, and what stays out.
• Roles set for front desk, marketing staff and vendors; activity log on.
• Each campaign classified: treatment or own-service message, or marketing that needs authorization.
• Restriction and confidential communication requests recorded and checked before sending.
• One suppression list for email and text, synced to each sending tool, with dates recorded.
• Decision written down on whether the CRM is part of the designated record set.
• Retention period set for leads and former patients; return or destroy step planned for the end of the contract.
• State consumer health data laws checked for the states your leads come from.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For CRM and marketing automation, that means lead forms and follow-up workflows that carry only the fields each message needs, with opt-outs that reach each tool that sends. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 45 CFR 160.103: Definitions (business associate, protected health information)
• 45 CFR 164.501: Definitions (marketing, designated record set)
• 45 CFR 164.502: Uses and disclosures of protected health information: general rules
• 45 CFR 164.504: Uses and disclosures: organizational requirements
• 45 CFR 164.506: Uses and disclosures to carry out treatment, payment, or health care operations
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.514: Other requirements relating to uses and disclosures (minimum necessary)
• 45 CFR 164.522: Rights to request privacy protection for protected health information
• 45 CFR 164.524: Access of individuals to protected health information
• 45 CFR 164.308: Administrative safeguards
• 45 CFR 164.312: Technical safeguards
• 15 USC 7704: Other protections for users of commercial electronic mail
• 16 CFR 316.5: Prohibition on charging a fee or imposing other requirements on recipients who wish to opt out
• 47 CFR 64.1200: Delivery restrictions
• Washington RCW chapter 19.373: Washington my health my data act
• Nevada Revised Statutes chapter 603A

More in Practice websites, privacy and tracking