On this page
A healthcare CRM (customer relationship management system) keeps every lead and patient relationship in one place, from first inquiry to booked visit and follow-up. When a clinic's CRM holds protected health information (PHI) for a covered entity, the vendor needs to sign a business associate agreement (BAA), and anything sent back to ad platforms should carry outcomes, not health details. Curve Compliance, which takes CRM outcomes and credits each to the original ad click under a BAA it signs on every plan, checked HHS's rules and each CRM vendor's own page for this guide on November 2, 2026.
Book a call. Want CRM outcomes counted against the ads that drove them, without health details? Curve Compliance takes outcomes from CRMs, booking systems and call tracking through incoming webhooks, credits each to the original ad click and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What a healthcare CRM does
A CRM is the system your front desk and marketing team share. In a clinic it usually does five jobs:
- Captures leads. Web forms, calls, chats and referrals land in one list instead of separate inboxes.
- Tracks stages. New, contacted, booked, attended and converted, so you can see where leads stall.
- Runs follow-up. Tasks, reminders, emails and texts for people who asked for a call or missed a visit.
- Shows the source. Which campaign, ad or referral each lead came from, when the click is kept with the lead.
- Reports outcomes. How many leads became patients, and what they were worth, by source.
That last job is where a CRM meets advertising. The stages in your CRM are the outcomes your ad platforms need to learn from, and the CRM record is also where the health details live.
CRM meaning in healthcare
CRM stands for customer relationship management. In healthcare the customer is a prospective or current patient, so the CRM follows the relationship from first contact through booking, care and follow-up. Some CRMs are built only for healthcare. Others are general CRMs, such as HubSpot or Salesforce, used on a plan or service the vendor covers with a BAA.
CRM vs CDP vs EHR
Three systems often get mixed up. They do different jobs and hold different data:
| System | Main job | Typical data | Question it answers |
|---|---|---|---|
| CRM (customer relationship management) | Manage leads and patient relationships | Contact details, stage, source, notes and tasks | Which leads from last month booked? |
| CDP (customer data platform) | Collect events and profiles across tools and pass them to other systems | Website and app events, profiles and segments | What did visitors do across channels? |
| EHR (electronic health record) | Keep the clinical record of care | Diagnoses, treatments, visit notes and prescriptions | What care did this patient receive? |
Each one needs a BAA when it holds PHI for you. The EHR is the clinical record and should stay out of marketing tools. For CDPs, see HIPAA compliant CDPs.
Must a healthcare CRM sign a BAA?
Under HIPAA, a business associate is a person or company that, on behalf of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter” (45 CFR 160.103). A CRM that stores your leads and patients for you fits that description once those records include PHI. A covered entity may let a business associate hold PHI “if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502(e)). That assurance is the BAA.
HHS's cloud guidance is direct: “If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules.” HHS adds that this holds “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data” (HHS). Whether your CRM records count as PHI depends on who you are and what you store, so talk to your counsel.
Here is what six CRM vendors say on their own pages, opened November 2, 2026. Each name links to its BAA Directory entry.
| CRM | Signs a BAA? | Plan or condition | In the vendor's words | Source |
|---|---|---|---|---|
| HubSpot | Specific plans | Enterprise subscriptions with Sensitive Data turned on | “By identifying as a HIPAA Covered Entity or Business Associate, HubSpot can track the application of the Business Associate Agreement (BAA) and fulfill regulatory obligations.” | HubSpot Knowledge Base |
| Salesforce | Specific services | The HIPAA Covered Services named in a signed BAA | “Customer and Salesforce must sign a BAA that includes the HIPAA Covered Service” | Salesforce |
| Zoho CRM | Yes, on request | BAA template by email | “You can request our BAA template by sending an email to legal@zohocorp.com.” | Zoho CRM Help |
| GoHighLevel | Yes, with an add-on | HighLevel's HIPAA add-on | “BAA included: A signed Business Associate Agreement is provided as part of the package.” | HighLevel Support |
| Keap | Yes | After HIPAA Security Controls are turned on | “Keap offers customers the opportunity to execute our standard Business Associate Agreement Addendum” | Keap support |
| Pipedrive | No | Its terms rule out HIPAA use | “Pipedrive Services are not designed to comply with industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA)” | Pipedrive Terms of Service |
A BAA covers the vendor that signs it, on the plan or service it names. For a longer comparison, see HIPAA-compliant CRM integrations compared and the CRM and email tools in the BAA Directory.
Sending CRM outcomes to Google and Meta without PHI
Ad platforms learn from outcomes: who booked, who attended, who became a patient. The CRM record behind each outcome holds names, contact details and often the reason for the visit. HIPAA's marketing rule says “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing,” with narrow exceptions (45 CFR 164.508(a)(3)). HHS says “disclosures of PHI to tracking technology vendors for marketing purposes, without individuals' HIPAA-compliant authorizations, would constitute impermissible disclosures” (HHS). Meta's Business Tools Terms bar data that “includes or is based on, directly or otherwise, health information” (Meta). So send the stage, not the record:
- Keep the click ID with the lead. Store the ad click ID when the lead arrives, so the outcome can be matched to the click later. See what GCLID is.
- Send a neutral event per stage. A name such as event_5 for a qualified lead carries no health meaning. See event tracking on a healthcare website.
- Leave the record behind. No names, notes, diagnoses, visit reasons or pipeline names that describe care.
- Add a value if you bid on value. Use a stage-level value, not one per treatment. See conversion values for clinics.
Google's offline import is built this way: you save the click ID “along with whatever lead information you collect,” and later give it back “along with a few details about the type of conversion it was and when it happened” (Google). For the setup, see CRM lifecycle stages as conversions and lead routing from ad click to CRM, or book a call and Curve's team will map your stages with you.
Questions to ask before choosing one
- Will you sign a BAA, and on which plan? Get the plan or service name in writing before any PHI goes in.
- Which features does the BAA cover? Salesforce, for example, ties its BAA to the services it lists as HIPAA Covered Services (Salesforce).
- How do leads arrive? Forms, calls and chats should land with their source and ad click ID attached.
- Can stage changes leave the CRM as events? Look for webhooks or an export your attribution tool can read.
- Who can see what? Roles, audit logs and access controls for staff and agencies.
- What reaches ad platforms? Ask for the exact fields each platform receives, event by event.
How Curve Compliance helps
Curve Compliance connects your CRM to your ad results without sending the record. Curve receives outcomes from CRMs, booking systems and call tracking through incoming webhooks, from EHR and intake tools such as Healthie, Athenahealth, OptiMantra, IntakeQ and Jane through Keragon, and from offline conversion uploads from a CRM or EHR, then credits each to the original ad click. HubSpot and WhatConverts outcomes show as CRM revenue and close rate in Campaign Reporting, next to Meta and Google Ads spend for each campaign.
Conversions go to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. Each platform receives only a fixed list of fields, events can use neutral names, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve strips PHI before data reaches an ad platform. Curve is SOC 2 Type II, signs a BAA on every plan (Directory entry) and does the setup, typically live in about a week.
Sources, checked November 2, 2026: 45 CFR 160.103; 45 CFR 164.502; 45 CFR 164.508; HHS, Guidance on HIPAA and Cloud Computing; HHS, Use of Online Tracking Technologies; Google Ads Help, About offline conversion imports; Meta Business Tools Terms; HubSpot, Store Sensitive Data in HubSpot; Salesforce, Business Associate Addendum Restrictions; Zoho CRM Help, HIPAA Compliance with Zoho CRM; HighLevel, HIPAA Compliance With HighLevel; Keap, HIPAA Security Controls for Keap; Pipedrive Terms of Service.
Frequently Asked Questions
What is a healthcare CRM?
A healthcare CRM is a customer relationship management system that keeps every lead and patient relationship in one place, from first inquiry to booked visit and follow-up. If it holds PHI for a covered entity, the vendor needs to sign a BAA.
What does CRM stand for in healthcare?
CRM stands for customer relationship management. In a clinic, it tracks prospective and current patients from first contact through booking, care and follow-up.
What is the difference between a CDP and a CRM?
A CRM manages relationships with known leads and patients: stages, tasks and follow-up. A CDP collects events and profiles across your tools and passes them to other systems; see HIPAA compliant CDPs.
Does a healthcare CRM need to sign a BAA?
Yes, if it creates, receives, maintains or transmits PHI for a covered entity, because that makes the vendor a business associate (45 CFR 160.103). HHS says storing ePHI with a cloud vendor “without entering into a BAA” violates the HIPAA Rules (HHS).
Which CRM is HIPAA compliant?
Several CRM vendors sign a BAA on named plans: HubSpot on Enterprise with Sensitive Data, Salesforce for its HIPAA Covered Services, Zoho CRM on request, GoHighLevel with its HIPAA add-on and Keap once HIPAA Security Controls are on (see the BAA Directory). Pipedrive's terms say its services are not designed to comply with HIPAA (Pipedrive).
Is HubSpot HIPAA compliant?
HubSpot supports HIPAA-covered data on Enterprise subscriptions with Sensitive Data turned on, where you select “We are a HIPAA-covered entity or business associate” and accept its BAA (HubSpot; Directory entry). See the HubSpot verdict.
Can I send CRM data to Google Ads or Meta?
Send outcomes, not records: a neutral event for each stage, matched by the ad click ID, with no names, notes or visit reasons. HIPAA requires an authorization for most uses of PHI for marketing (45 CFR 164.508), and the BAA Directory lists Meta and Google Ads as not signing a BAA (Meta; Google Ads).
Talk to Curve Compliance
Book a call. Want your CRM outcomes working for your ads without the record going to ad platforms? Curve Compliance credits each CRM outcome to the original ad click, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.