Looking for a HIPAA compliant CRM? Get one with a BAA on every plan.

What HIPAA asks of a CRM

What makes a CRM HIPAA compliant?

HIPAA doesn't certify software. It puts duties on covered entities and their business associates. If your CRM vendor stores or handles protected health information (PHI) for you, it is your business associate, and you need four things from it.

1. A signed BAA. The contract that makes the vendor responsible for safeguarding PHI and reporting breaches. Without it, putting PHI in the CRM is a violation in itself. HHS has settled cases over missing BAAs alone, such as $750,000 with Raleigh Orthopaedic Clinic in 2016 (HIPAA Journal).
2. Encryption. Data encrypted in transit and at rest.
3. Access controls. Each person sees what their role needs, and nothing else.
4. Audit and backups. A record of activity, and backups so data survives an outage.

Ask every vendor, us included, to show you how roles, permissions and activity history work before you sign. Then there is your side. A BAA doesn't do your risk analysis, write your policies or train your staff. Compliance is shared between you and the vendor, and your compliance advisor is the right person to confirm your setup.

Who actually needs a HIPAA compliant CRM?

Not every health or wellness business is covered by HIPAA. A health care provider is a covered entity if it sends health information electronically in a standard transaction, like an insurance claim or an eligibility check (HHS).

• Likely covered: physical therapy, chiropractic and therapy practices that bill insurance; med spas with a medical director, prescribing or electronic lab orders (AccountableHQ).
• Possibly not covered: cash-only providers who never transmit standard transactions may fall outside HIPAA (ASHA). Purely cosmetic salons and spas usually aren't covered entities.
• Still careful: state laws like Washington's My Health My Data Act and the FTC's Health Breach Notification Rule can apply even where HIPAA doesn't.
• Business associates: an agency or consultant that handles a clinic's patient data needs BAAs too.

The CRM itself

HIPAA compliant CRM software that runs the front office

JBMOnboard360 keeps every client, lead, note, file and conversation in one profile. Around that record you get:

• Scheduling for your team, rooms and services, with booking requests. See HIPAA-ready scheduling.
• Intake and feedback forms with QR codes, built in the custom form builder. See HIPAA-ready intake forms.
• Invoicing, discounts, prepaid cards and payment tracking.
• A help desk with SLAs, escalation and a knowledge base. See the help desk with a BAA.
• A lead inbox with follow-up reminders and a daily list of who needs a call.
• Team chat with audio and video calls, and AI meeting summaries saved to the client record.
• Headquarters view across locations, with each location's own team, data and dashboard.

Honest limits

When JBMOnboard360 is not the right fit

• You need an EHR. JBMOnboard360 is not an EHR or EMR. It doesn't do clinical charting, treatment notes or insurance billing. Practices keep their clinical system, and JBMOnboard360 handles clients, scheduling, intake, invoicing, the help desk and follow-up around it.
• You need card payments or memberships in the US. We send invoices and track payments, but we don't process cards, and we don't sell memberships or packages in the US yet.
• You rely on SMS. We don't send text messages in the US. The AI concierge answers WhatsApp enquiries about prices, hours and callbacks. Keep health information off WhatsApp.
• You need specific integrations. Ask us about your setup in the consultation before you assume one exists.