CRM for dental and medical practices: practice management software, marketing CRMs and HIPAA

Start with what you already have

Searching for a CRM for a dental practice, you will find two different kinds of product sold under one name.

1. Practice management software. It holds the patient chart, schedule, insurance, billing and recall. Examples are Open Dental, Dentrix and Curve Dental. Open Dental’s site describes it as practice management software for dental offices. Dentrix’s site describes an all-in-one platform covering scheduling, billing and patient engagement, including online booking, reminders and two-way texting. Curve Dental’s site describes a cloud platform covering clinical care, scheduling, billing and patient engagement. None of the three shows prices on the pages we read in October 2026; Curve says pricing depends on practice size and features.
2. A marketing CRM. It tracks people before they are patients: who inquired, from where, and whether they booked. HubSpot, Less Annoying CRM and GoHighLevel are examples of tools that can do this.

The first is where patient information lives. The second is optional. Before you pay for a second system, ask whether your practice software already does what you want: reminders, recall, online forms, review requests and inquiry tracking are often built in or sold as modules.

This article is general information, not legal advice. For a wider look at choosing a tool, see how to choose a CRM, and for our own approach see CRM setup.

Why HIPAA comes first

Under the HIPAA rules (45 CFR 160.103), a business associate is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information. A dental practice is a covered entity. Information that identifies a person and relates to the provision of health care counts as protected health information, and that includes a patient’s name tied to a request for an appointment.

So the question is not whether a CRM holds clinical notes. It is whether anything a patient submits, or your front desk records, identifies a person who is asking for care. If it does, the vendor that stores it for you needs to sign a business associate agreement (BAA) with your practice first.

Three points practices often miss:

• A “HIPAA compliant” label is not a signed agreement. Curve’s FAQ says it is built with HIPAA-compliant infrastructure and security controls. That is a helpful statement. Your practice still needs the agreement itself.
• An agreement can cover some features and not others. HubSpot’s BAA applies to the features HubSpot lists as covered in its product catalog, and its terms name some kinds of sensitive data that are not permitted in any feature at all. Check which features your plan includes.
• Every connected tool counts. A website form, a texting tool, a chat widget and a CRM can each pass patient information along. Each vendor in the chain needs to be covered, or the form should not collect patient details.

Veterinary practices are not covered by HIPAA, though state rules on records can apply.

What the CRM options say about HIPAA

These are statements from the vendors’ own pages, as we read them in October 2026. They are starting points for questions to ask, not confirmations.

Ask each vendor three questions in writing: Will you sign a BAA for my account? Which plan and features does it cover? What happens to the data when I leave?

What a CRM can safely hold without a BAA

If no agreement is in place, keep the CRM to information that is not about anyone’s care:

• A company or person’s name and contact, with the general interest “teeth whitening” and no appointment request
• Referral partners, such as dental labs, specialists and local employers
• Marketing lists for people who opted in to a newsletter, with no health details
• Business contacts and vendors

Patient names, appointment requests, treatment interest tied to a named person, insurance details and chart notes belong in the practice management system or another tool covered by an agreement.

A simple setup for a practice

1. Use the practice software as the patient record. Keep scheduling, recall and billing there.
2. Decide what the website collects. A patient’s name with a request for a call back or an appointment can already be protected health information, so the form tool and wherever it sends the data need an agreement. If they do not have one, link to your booking system or ask people to call the front desk instead.
3. Track new-patient sources. Ask each new patient how they found you, and record it in the practice software or a field there.
4. Add reminders for the front desk. An open inquiry with no reply after a set time is a task for a person.
5. Review monthly. Count inquiries, bookings and the lead sources that produced them.

Texting needs its own care. Automated texts need the patient’s consent (TCPA), business texting numbers need carrier registration (A2P 10DLC), and a text that identifies a patient and an appointment is protected health information. The same applies to our work with website to CRM integration: we connect a form to a CRM, and for a practice we list each vendor in the written scope so you can obtain the agreements.

When a separate CRM is worth it

A marketing CRM pays back in a practice that:

• Runs ads or referral programs and wants to see which source brings new patients
• Has several locations or a marketing person who is not at the front desk
• Wants follow-up sequences for people who inquired and did not book

Even then, the safe pattern is to keep patient detail out of it unless the agreement is signed and the features are covered. For a practice with one location and a busy front desk, the practice software plus a disciplined call-back habit is often enough.

What changes for medical, chiropractic and therapy practices

The same logic applies to medical offices, chiropractors and physical therapists. The practice management or electronic health record system is the home of the patient record, and a marketing CRM sits beside it for people who have not yet become patients. Plans of care and recall visits make follow-up especially valuable in these practices, so the question is how to remind patients without putting health details in the wrong tool. A message that says “it is time to book your next visit” carries less health information than one that names a treatment, and either way the vendor sending it needs an agreement if it identifies the patient. Ask your practice software vendor what recall and reminder tools it already includes before adding another.

Questions to ask before you sign

• Will you sign a BAA, and does it cover the exact plan and features I would use?
• Where is the data stored, and who at your company can see it?
• What does it cost for my number of users, including texting and email?
• Can I export every record if I leave?
• Does it connect to my practice management system, or will someone retype data?

If you want a second opinion on which tool fits, or a form on your site connected to the right place, ask for a free demo.

Published October 26, 2026. Updated October 26, 2026.