Healthcare CRM: Do You Need One Next to Your EHR?

A healthcare CRM is a list of people who reached out to your practice and have not become patients yet, with where each came from and what happens next. If your EHR already books, bills and reminds, and few inquiries slip away, you may not need one.

Quick answer

• Count last month's inquiries (calls, forms, texts). Fewer than you can follow on one shared list, and a CRM mostly adds work.
• If you cannot say how many callers never booked, or which ads the booked ones came from, the gap is real, and that gap is what a CRM is for.
• Before any real inquiry goes in, get the vendor's business associate agreement (BAA, the contract HIPAA requires with a vendor that handles patient information) in writing, with the plan it covers.
• Decide who turns a booked lead into a patient record, and how "showed" or "no-show" returns to the CRM.
• Only then connect it to Google Ads or Meta, and send as little as possible.

What does a CRM hold that your EHR does not?

An EHR or practice management system records people who are patients: visits, charts, claims. A CRM records the stretch before that, which an EHR may have nowhere to put.

If your EHR already has a lead or "prospect" status and a source field, you may be closer to a CRM than you think. My post on getting appointment outcomes out of your EHR covers what the EHR can report, and best EHR for a small practice is about choosing one.

Which practices can skip a CRM?

Run three checks on last month's data.

• Open the phone log and the form inbox and count inquiries. Then count how many got a reply within one business day. If almost all did, follow-up is not your problem.
• Ask the front desk where booking happens. If it happens inside the scheduling tool the EHR already provides, the hand-off is short.
• Ask whether the EHR or scheduling tool already sends reminders and recalls. If yes, you would not buy the CRM for that.

Three yeses mean a source column in the scheduling tool may be enough. If a callback list lives in someone's notebook, or two ads and a listing all send calls to one number, the CRM is solving a real problem.

Which vendors state a BAA on their own pages?

If your practice is a HIPAA covered entity (a provider that sends health information electronically for transactions such as claims), a CRM that stores a name plus a health inquiry holds protected health information. HHS defines a business associate as a person, companies included, who creates, receives, maintains or transmits that information on a covered entity's behalf (eCFR, 45 CFR 160.103, checked 2026-10-15). You may let one hold that information only after it gives written assurances in a contract that meets HHS's terms, and that contract is the BAA (eCFR, 45 CFR 164.502(e), checked 2026-10-15). In Canada, PIPEDA keeps an organization responsible for information transferred to a third party for processing and asks for contractual protection (PIPEDA, Schedule 1, 4.1.3, checked 2026-10-15), and in Ontario a health information custodian remains responsible for what its agents do with personal health information (PHIPA, s. 17, checked 2026-10-15).

The table uses only what each vendor's own pages said when I fetched them. It is not a ranking, and "not stated" means the page did not say.

All checked 2026-10-15. Several of these pages speak to hospitals and large organizations, so a small practice should get the plan, the BAA and the price for its size in writing. A vendor that calls itself "HIPAA-compliant" has said it about itself; the signed BAA and the plan it names are what you can hold the vendor to.

What happens when a lead books?

This is the step where a lead can drop out of sight. The lead sits in the CRM; the patient is created in the EHR. Someone or something has to bridge the two.

• Who creates the patient record, and when? Name the person, not "the system."
• What identifies the same human in both places? A phone number alone breaks when a spouse books for a patient.
• How does "showed," "no-show" or "canceled" return to the CRM? Native integration, a scheduled export, or a person updating a field. A person works if the volume is small and a named role owns it every day.

For a US medical practice I linked DrChrono to Google Ads so that each booking keeps the ad click id, and visits marked booked or completed return to Google Ads as offline conversions. None of that works unless the visit status comes back first; without it, every report downstream is guesswork.

Can showed patients be sent back to Google Ads or Meta?

Yes, with limits. Google describes it this way: each ad click gets an id, you store it with the lead, and later you send it back with the conversion type and when it happened (Google Ads Help, checked 2026-10-15). Enhanced conversions can add first-party data such as the email from the form, hashed with SHA256 before it is sent to Google (Google Ads Help, checked 2026-10-15).

Meta's Conversions API can upload events from a CRM, and its Conversion Leads goal currently works only with Meta's own lead ad forms (Meta for Developers, checked 2026-10-15). The steps are in offline conversion tracking from a CRM to Google Ads; I will not repeat them.

Four cautions for a practice:

1. Send no condition or treatment names. Name the event something neutral, like "appointment completed."
2. Do not build audiences from the list. Google lists Health among its sensitive interest categories, and advertisers promoting in those categories cannot use audiences they build themselves, Customer Match and data segments included (Google Ads policy, checked 2026-10-15).
3. In the US, HHS's bulletin on tracking technologies says that, without patients' authorization, a tracking vendor that receives protected health information needs a signed BAA, and that the vendor's agreement to remove or de-identify it before saving is not enough (HHS, checked 2026-10-15 via the Internet Archive). On June 20, 2024, a Texas federal court vacated only the part it called the "Proscribed Combination," an IP address paired with a visit to a page that needs no login and covers a specific health condition or provider, and wrote that the vacatur should not be read as limiting the bulletin's other guidance (court opinion, AHA v. Becerra, checked 2026-10-15).
4. In Canada, PIPEDA says express consent is generally the form to seek for sensitive information and names medical records as almost always sensitive (PIPEDA, Schedule 1, 4.3.4 and 4.3.6, checked 2026-10-15).

Ask your privacy counsel what applies to your practice before the first upload. This is not legal advice, and I am not a lawyer.

What does one quarter look like with the source recorded?

Illustrative: the figures below are invented for an imaginary small dental office; no client supplied any of them.

Over a quarter it received 200 inquiries and spent $6,000 on Google Ads and $3,000 on Meta. Before the CRM, the EHR showed 84 new patients who came in, so the cost looked like $9,000 / 84, about $107 per showed patient. After the CRM recorded the source on every inquiry:

Formula to repeat: ad spend divided by patients who showed from that source. The blended $107 hid a $182 channel and a $500 one, and it counted referral and listing patients the ads did not bring. A source recorded on every inquiry also shows where people drop: Meta booked 9 of 30, Google Ads 44 of 80.

What should I ask in a demo?

• Show a BAA, the plan it covers and any feature or add-on it excludes.
• Create a test lead from my web form: does the source and click id arrive on its own?
• Show how a booked lead becomes a patient in my EHR, and what returns when the patient shows.
• Export every lead with notes in a file I can open without you.
• Who at your company can see my records, and how do I remove access?
• What does it cost for my user count, in writing, with renewal terms?
• Can a no-show be flagged without typing it twice?

For the ad side of the same decision, see how to choose a healthcare marketing agency.