HIPAA-Compliant CRM: What Healthcare Teams Actually Need

By Darryl Pryor, CEO at Conduyt · Updated May 2026

There is no such thing as a “HIPAA-certified CRM,” and any vendor that tells you otherwise is selling you something other than the truth. HIPAA is not a certification program. It is a set of legal obligations that fall on the organization handling protected health information, and the software the organization uses has to support those obligations without breaking them.

This guide explains what “HIPAA-compliant CRM” actually means, what to look for, what questions to ask vendors, and how Conduyt is designed to support HIPAA workflows for the healthcare teams that use it.

What HIPAA actually requires

HIPAA, the Health Insurance Portability and Accountability Act, governs how covered entities and their business associates handle protected health information (PHI). The relevant pieces for software vendors are:

• The Privacy Rule. Limits who can access PHI and what they can do with it.
• The Security Rule. Requires administrative, physical, and technical safeguards for electronic PHI (ePHI).
• The Breach Notification Rule. Requires reporting when PHI is exposed.
• The Business Associate provision. Any vendor that handles PHI on behalf of a covered entity is a “business associate” and has to sign a Business Associate Agreement (BAA).

Notice what is missing from that list: a certification. There is no government body that stamps software “HIPAA compliant.” The Office for Civil Rights (OCR) at HHS enforces HIPAA after the fact, through audits and investigations. Compliance is a posture, not a badge.

What this means for picking a CRM: the question is not “is this CRM HIPAA-certified.” The question is “does this CRM, combined with how my team uses it, let me meet my obligations under HIPAA.” Those are very different questions.

What a HIPAA-supporting CRM actually needs

A CRM that healthcare teams can use without violating HIPAA needs to handle five categories of work. If any one of them is weak, the CRM creates risk no matter what the vendor’s marketing page says.

1. Access controls. Role-based permissions, so only the people who need PHI can see it. User authentication, ideally with single sign-on and mandatory two-factor. Granular permissions on records, not just on features.

2. Audit logs. A record of who looked at what, when, and from where. HIPAA requires this. A CRM that does not log access to individual records cannot support HIPAA workflows, full stop.

3. Encryption. Data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent). This is table stakes in 2026. Any vendor that cannot answer encryption questions in one sentence is not ready to handle PHI.

4. A signed BAA. The Business Associate Agreement is the legal document that makes the vendor responsible for protecting PHI. No BAA, no PHI in the system. Period.

5. Breach response. Incident response procedures, breach notification commitments, and clear timelines. When something goes wrong (and at some point, somewhere in the industry, something always does) the vendor has to be able to tell you what happened, when, and to whose data.

These five categories are what “HIPAA-compliant CRM” really means in practice. Everything else is either nice to have or noise.

Why most CRMs are not built for this

Most general-purpose CRMs were designed for business-to-business sales teams whose data is contact info, deal stages, and meeting notes. PHI is a different category of data with different consequences when it leaks. A CRM that treats every record the same way (same logging, same encryption, same access controls) was not designed with PHI in mind.

The specific places general-purpose CRMs fall down:

• Audit logs are incomplete. They log changes but not reads. HIPAA requires read logging for PHI.
• Email integrations leak PHI. The CRM syncs every email automatically, including ones that contain PHI in subject lines, into systems that were not designed to hold it.
• Custom fields are not classified. Once you add a field for “diagnosis” or “medication,” the CRM has no concept that this field needs special handling.
• No BAA available. Many CRMs, especially in lower price tiers, simply will not sign a BAA. This makes them unusable for any team handling PHI, regardless of feature set.
• AI features train on customer data. Some CRMs use customer interactions to improve their AI models. If those interactions include PHI, that is a problem the BAA needs to address.

A healthcare team using a general-purpose CRM is not necessarily violating HIPAA, but they are doing more of the compliance work themselves than they should have to. The CRM should make the right thing easy and the wrong thing hard.

How Conduyt is designed to support HIPAA workflows

A note before this section: Conduyt is designed to support HIPAA workflows. Whether your specific use of Conduyt meets your HIPAA obligations depends on your configuration, your policies, and how your team uses the system. If you need a BAA, contact us at our trust page and our legal team can walk you through whether Conduyt is the right fit for your situation.

Here is what we have built and why:

Encryption. All data encrypted in transit with TLS 1.2 or higher. All data encrypted at rest with AES-256. Encryption keys managed through AWS KMS with annual rotation. This is documented on our trust page.

Access controls. Role-based access control with custom roles. Granular per-record permissions. SSO support including SAML 2.0 and OIDC. Mandatory two-factor available at the org level for accounts that need it.

Audit logging. Every read and write to a record is logged. Logs include user, timestamp, IP address, and the specific record touched. Logs are retained for seven years and exportable on request.

SOC 2 Type II certification. Audited annually by Prescient Assurance. The SOC 2 report covers our security, availability, confidentiality, and processing integrity controls. Available under NDA on request through the trust page.

Incident response. 24-hour breach notification commitment in our BAA. Documented incident response procedures. Annual tabletop exercises.

AI and PHI. Conduyt’s AI features do not train on customer data. The 104-tool MCP server operates over your data with your permissions; it does not export to model training pipelines.

What we do not claim: we do not claim Conduyt is “HIPAA-certified,” because no such certification exists. We do not claim that using Conduyt automatically makes your organization HIPAA-compliant; that depends on your overall program. We can sign a BAA with qualifying customers, and we are designed to make HIPAA workflows possible without fighting the software at every turn.

How CRM is used in healthcare

The use cases where a HIPAA-supporting CRM matters most:

Patient relationship management. Tracking patient communications, appointment history, referral sources, and care coordination across providers. Often replaces or augments a practice management system for the relationship side specifically.

Provider networks. For multi-provider practices and health systems, tracking referring physicians, specialist networks, and referral patterns. The contacts here are providers, not patients, but the data still touches PHI.

Payer relationships. For health plans and insurance, managing broker relationships, group accounts, and member communications.

Pharma and life sciences sales. Calling on healthcare providers, tracking samples distributed, managing speaker programs and educational events. Subject to HIPAA when PHI is involved and to Sunshine Act reporting when payments are.

Healthcare technology and services vendors. B2B sales into hospitals and practices, where the customer relationships may not involve PHI directly but where the vendor often becomes a business associate the moment they start handling data.

The thread across all of these: relationships matter, the data is sensitive, and the compliance overhead is real. A CRM that ignores any of those three is the wrong tool.

What to ask a CRM vendor before you trust them with PHI

Six questions. Get the answers in writing.

1. Will you sign a BAA? If the answer is no or “for an extra fee,” the conversation is over.
2. What encryption do you use, at rest and in transit? Should be AES-256 and TLS 1.2+ at minimum.
3. What does your audit log cover, and how long is it retained? Should cover reads and writes, both, with at least six years of retention to match HIPAA’s records-retention rule.
4. What is your SOC 2 status, and who audits you? SOC 2 Type II from a recognized firm, audited annually.
5. Do your AI features train on customer data? If yes, what is the opt-out mechanism, and does the BAA cover this?
6. What is your breach notification timeline, and what does your incident response process look like? Should be clear, fast, and documented.

If a vendor cannot answer all six of those quickly and confidently, they are not ready to be a business associate for your organization.

Frequently Asked Questions

Is any CRM truly HIPAA-compliant?

No CRM is “HIPAA-compliant” in the sense of being certified, because HIPAA does not have a certification program. The question is whether the CRM is designed to support HIPAA workflows and whether the vendor will sign a BAA. Several CRMs meet both criteria, including Conduyt.

Do I need a BAA with my CRM vendor?

If you are a covered entity or a business associate, and the CRM will store any protected health information, yes. A signed BAA is a legal requirement under HIPAA, not optional.

Can I use a general-purpose CRM like HubSpot or Salesforce for healthcare?

You can, but you have to use the specific configurations they offer for healthcare customers, sign their BAA where one is available, and be careful about which features create compliance risk (email integrations, AI features, integrations with third-party tools). Most teams find that a CRM designed for the workflow from the start is easier than retrofitting a general-purpose one.

What is the difference between HIPAA-compliant and HIPAA-supporting?

“HIPAA-compliant” implies a certification that does not exist. “HIPAA-supporting” or “designed to support HIPAA workflows” is the accurate framing: the software has the controls in place, but your organization is still the one responsible for meeting its HIPAA obligations through how it uses the software.

How much does a HIPAA-supporting CRM cost?

It varies. Some vendors charge a premium for the BAA, the audit logging, and the encryption features. Conduyt’s flat-rate pricing ($299/month Starter, $499/month Professional, both with unlimited users) includes the security features that healthcare teams need; we do not charge extra for what HIPAA requires.

A note on picking one

Healthcare teams evaluating CRMs often make the same two mistakes. They either over-rotate on the HIPAA piece and end up with a clunky industry-specific tool that is bad at being a CRM, or they under-rotate and pick a slick general-purpose tool that fights them on compliance. The right answer is usually a CRM that takes HIPAA seriously without making it the only thing the product knows how to do.

If you want to see what that looks like, start a 20-day free trial or book a demo. Bring your real workflow. If we are not the right fit for your compliance needs, we will tell you.

Darryl Pryor is CEO of Conduyt, the flat-rate AI-native CRM. SOC 2 Type II certified by Prescient Assurance. $299/$499 per month, unlimited users. Start a free trial.