Automating a CRM that holds patient data? Here is what HIPAA asks of your vendors, and what we do.
Compliance sits in your contracts and your setup, not in a badge on a tool.
HIPAA compliance depends on your setup and contracts, not on one tool. Where it applies, each vendor needs a BAA with you before patient data flows. We work inside your accounts. Start with the checklist.
Page updated October 19, 2026.
On this page
What does HIPAA actually ask of a CRM vendor?
Where HIPAA applies to you, a vendor that creates, receives, maintains or transmits patient data on your behalf generally needs a business associate agreement (BAA) with you before any patient data goes in.
HHS calls such a vendor a business associate, and the covered entity must get satisfactory assurances, in a BAA, that the vendor will safeguard the information. A cloud provider that stores only encrypted data, without holding the key, is still a business associate.
The BAA, your own configuration and your internal safeguards decide whether your use meets the rules; a vendor's badge does not. For a CRM this means checking the plan you are on, because some vendors sign a BAA only on specific tiers. The same applies to your email service, hosting and pharmacy.
We are not lawyers, we give no legal advice, and we do not certify HIPAA compliance. Ask your counsel which rules apply to you.
Where does the HHS information come from?
Sources: U.S. HHS Office for Civil Rights guidance, checked October 19, 2026. Read HHS guidance on business associates and HHS guidance on HIPAA and cloud computing.
Is a BAA needed before we connect a CRM?
Where HIPAA applies, treat a signed BAA with each vendor as a prerequisite, before any patient data goes into the system.
That covers the CRM, the email service, the hosting and the pharmacy. We do not connect a vendor that has not signed the BAA your setup requires.
If a vendor will not sign one for your plan, the answer is a different plan or a different vendor, not a workaround.
An EHR is one more vendor on that list. The EHR integration guide shows what to ask it about API access and a BAA.
What access do you need, and how is it limited?
Only what the integration needs, created by you in your own accounts after we have signed your NDA, and removable by you at any time.
- The checklist and the call need no patient records.
- During the build we use test records.
- Production access starts only after we have signed your NDA, is limited to what the integration needs, and stays in your accounts.
- You revoke our access at handover, and we keep no copies.
- Audit trails live in your accounts' own activity logs, which you control.
- We do not keep patient data on systems we control.
In the EU, GDPR applies and you remain the controller of your data.
The integration readiness checklist has a section for the vendor paperwork.
What should you ask a CRM vendor before patient data goes in?
Ask these questions and keep the answers in writing.
- Will you sign a BAA with us, and for which plan or product tier?
- Are any features of that plan outside the BAA?
- Where is our data stored, and which sub-processors can reach it?
- How is access logged, and can we export the logs?
- Can we restrict each user to the data they need?
- What happens to our data when we cancel?
- What is your process for telling us if something goes wrong with our data?
For the connection itself, see healthcare CRM integration.
Can GoHighLevel be used with patient data?
It depends on your plan and on whether HighLevel signs a BAA with you. Get that in writing before any patient data goes in.
The same questions apply to HubSpot, Salesforce and any other CRM. We can build automations on any of them, and we do not certify any of them.
What do we never claim?
We do not certify HIPAA compliance. We also do not certify any other compliance, give legal or clinical advice, host patient data, or build EHRs or telemedicine apps.
- We never say that a tool, or a project we worked on, makes you compliant.
- We never give legal advice.
- We never ask for patient information through this website.
How do we start?
With the free readiness checklist. Then, if it helps, a 30-minute call that you book yourself in a free slot.
Get the integration-readiness checklistOr book a 30-minute callor write to [email protected]