Built for teams who need a signed BAA to use their CRM

The CRM that signs the BAA at Pro tier, not Enterprise.

Most CRMs gate HIPAA behind a six-figure annual commit at the top plan. Strkr makes the BAA available on request, keeps the posture honest about what it covers, and ships the PHI field classification, audit log, and AI retrieval scoping that an actual HIPAA deployment needs.

Start free trial See pricing

What this audience is actually dealing with

The pains that bring buyers here.

A HIPAA-compliant CRM is a procurement motion. The compliance officer wants a BAA, a subprocessor list, a breach notification clause, and documented controls. The product team wants a CRM that handles patient records, referrals, outreach, and clinical workflow. Most vendors treat the two needs as a tier upsell. The pain points below are what procurement leads and compliance officers raise on every intake call for a HIPAA-covered deployment.

The Enterprise-tier BAA gate

HubSpot, Salesforce, Zoho all gate the BAA to the top tier.

HubSpot requires Enterprise plans. Salesforce requires an Enterprise or Health Cloud commitment. Zoho requires Zoho One Enterprise. The annual commit sits in the six-figure range for a mid-size clinic. Strkr offers the BAA on request, which keeps the compliance capability available to any team without an enterprise gate.

Opaque subprocessor lists

The vendor cannot name who touches PHI.

A HIPAA-compliant deployment needs transparency on which third parties process PHI. Most CRM vendors publish a long subprocessor list and hide the ones that actually touch tenant data behind an enterprise-only disclosure gate. Strkr's subprocessor list runs about seven entries, is public on request, and each PHI-touching entry carries a signed BAA.

Audit log for OCR

The record read is not logged.

HIPAA audits examine record read, not just record write. A CRM that only logs write actions cannot prove minimum-necessary access. Strkr logs every record read, write, export, email send, and AI call with user, timestamp, record ID, and action. Default retention is 90 days, tunable to the six-year HIPAA minimum.

AI retrieval across PHI

The AI pulls from other patients to answer a question.

Most CRM AI retrieves across the full tenant corpus. For HIPAA that creates a minimum-necessary violation (the AI call references PHI from other patient records to compose a response). Strkr AI runs with retrieval scope strictly scoped to the active patient record by default. Cross-patient retrieval requires explicit admin enablement for a workflow.

Export without PHI classification

The CSV download includes every field.

A CRM admin who exports a segment to CSV typically gets every field including PHI. For HIPAA the export needs minimum-necessary enforcement. Strkr tags PHI-bearing fields with a classification level and the export respects the classification by default. The admin role can override for documented use cases, and the override logs to the audit trail.

Patient communication templates

The text reminder leaks diagnosis.

A sloppy appointment reminder template leaks diagnosis or provider specialty through the SMS content. Carriers can log the content, and the patient may not have consented to the disclosure. Strkr ships HIPAA-safe templates that reference the appointment time and clinic name without the PHI leak. The admin can review and tune every template before deployment.

What the Strkr BAA covers

The clauses that matter.

A BAA is a legal document. The clauses that matter for a HIPAA deployment are subprocessor flow-down, breach notification timeline, use restriction, termination rights, and record retention. The cards below are the concrete posture of each clause in the standard Strkr BAA.

Subprocessor flow-down

Each subprocessor carries a signed BAA.

Strkr requires a signed BAA with each subprocessor that touches PHI. The subprocessor list is public on request. Additions trigger 30-days notice to the covered entity. The posture matches what mid-market healthcare buyers typically need to clear their internal compliance review in the first quarter.

Breach notification

Written notice within 60 days.

The standard Strkr BAA commits to written notice of a reportable breach within 60 days of discovery, which matches the HIPAA minimum. For deployments that require shorter windows (24 hours, 72 hours) the compliance team can negotiate the notification timeline at Scale tier.

Use restriction

PHI used only for the stated service.

The BAA restricts PHI use to the stated service (the CRM functionality). The AI calls do not train on tenant data. The aggregate analytics (platform-level usage metrics) strip PHI before computation. The compliance officer can request the data flow diagram for internal review.

Termination rights

Return or destroy on termination.

On termination of the agreement the standard posture is return of PHI to the covered entity in a documented format or destruction with written attestation. The covered entity selects the posture at termination. The tenant data export runs through the API or a Strkr-managed data egress depending on size.

Record retention

Audit log tunable to the HIPAA minimum.

Default audit log retention is 90 days. Tunable per tenant to the six-year HIPAA minimum for most record types. The compliance officer can export the audit log for an OCR audit or an internal review through the API or the admin console.

Access control attestation

Role-based scoping documented.

The role matrix lets the admin scope access by patient segment, encounter type, and note type. The matrix exports to a documented control attestation that the compliance officer can share with auditors. The attestation shows who has access to what and under what role.

Encryption and key management

KMS at rest, TLS 1.3 in transit.

Tenant data lives encrypted at rest with AWS KMS keys. Traffic runs TLS 1.3 end to end. Integration tokens live in AWS Secrets Manager with per-tenant isolation. The compliance officer can request the current encryption posture document for internal review.

How Strkr handles PHI inside the product

The field, the retrieval, and the export.

A HIPAA-compliant CRM is more than a signed BAA. The product has to classify PHI, scope AI retrieval, enforce export minimum-necessary, and log every record access. The cards below are the concrete controls inside the Strkr product.

PHI classification

Tagged fields with scoping rules.

The schema tags PHI-bearing fields (patient identifiers, diagnosis codes, treatment detail, insurance IDs) with a classification level. The admin can mark custom fields as PHI. The classification drives export scoping, AI retrieval scoping, and audit log classification automatically.

AI retrieval scope

Patient-scoped by default.

Export minimum-necessary

CSV strips PHI by default.

A segment export to CSV strips PHI by default. The admin role can override with documented reason, and the override logs. The CSV contains the minimum-necessary field set for the business purpose. For deeper exports the admin uses the API with per-call PHI scope enablement.

Audit log classification

Every PHI access logged.

Every record read on a PHI-tagged field writes to the audit log with user, timestamp, record ID, field, and action. The log is immutable and signed. The compliance officer can filter the audit log by user, by patient, by role, and by time window to produce a HIPAA access record on demand.

Role-based access control

Minimum-necessary enforcement.

The role matrix enforces minimum-necessary access by scoping field visibility per role. A front-desk receptionist sees the appointment and demographic record, not the clinical note. A billing clerk sees the insurance detail and the invoice history, not the diagnosis. The admin tunes per role and the configuration logs.

Patient communication guardrails

HIPAA-safe templates by default.

Appointment reminder templates reference the appointment time and clinic name without leaking diagnosis, provider specialty, or treatment context. Email templates include the HIPAA minimum-necessary disclosure. The admin can review and tune every template before deployment, and the audit log records template changes.

Consent-aware outreach

Communication gated by documented consent.

The consent object attached to the patient record carries the scope of communication consent (clinical reminders, marketing, research). The outreach cadence respects the consent scope by default. A patient who has not opted into marketing communication does not receive marketing content, and the system blocks the send with a documented reason.

What the Strkr BAA does not cover

Honest scope limits.

A BAA has limits. The sections below are the places where Strkr is honest about what the posture does not cover, so the compliance officer can plan around the gaps.

EHR replacement

Strkr is a CRM, not an EHR.

Strkr is a CRM with HIPAA posture, not an EHR. Clinical note documentation, order entry, prescribing, and chart review live in the EHR. Strkr integrates with the EHR through the standard webhook spec. The CRM holds the referral, outreach, and relationship record; the EHR holds the clinical record.

Clinical decision support

The AI drafts outreach, not treatment.

Strkr AI drafts outreach, reminders, follow-ups, and administrative notes. The AI does not generate clinical decision support, dosing recommendations, or treatment plans. For deployments that need clinical AI the Strkr integration can route data to a clinical-AI vendor through the standard webhook spec.

HITRUST certification

HIPAA posture, not HITRUST today.

Strkr is HIPAA compliant with a BAA. HITRUST certification is on the roadmap and not yet complete. For deployments that strictly require HITRUST (certain payer contracts, certain large health systems) the compliance officer should wait or run a documented control review in parallel.

FedRAMP

Not applicable in the current posture.

Strkr does not hold FedRAMP authorization. For federal-agency deployments that require FedRAMP (certain VA, Department of Defense, Indian Health Service deployments) the compliance officer should plan around the current posture.

42 CFR Part 2

Honest about the scope.

For substance use disorder treatment records subject to 42 CFR Part 2, the Strkr BAA does not include the specific Part 2 clauses by default. The compliance team can negotiate the Part 2 clause set at the Scale tier for deployments that specifically require it.

International deployments

US-centric posture, EU on request.

The default posture is US-centric. For EU deployments the compliance team can negotiate a GDPR-plus-HIPAA posture with EU data residency on request at the Scale tier. The default US deployment carries the GDPR and CCPA posture today and will not be the right fit for every EU healthcare deployment.

Head-to-head

Strkr HIPAA posture vs typical CRM vendor posture.

The comparison below is the Strkr HIPAA posture versus a typical mid-market CRM vendor posture.

Feature	Strkr	Typical CRM vendor HIPAA posture
BAA tier availability	Available on request.	Enterprise tier only, high minimum.
Subprocessor list	Short, public on request.	Long, enterprise-only disclosure.
Breach notification	60 days default, shorter on Scale.	60 days or vendor discretion.
Audit log record-read coverage	Every read logged, 90-day default.	Write-only coverage typical.
PHI field classification	Tagged with export and AI scoping.	Treated as generic fields.
AI retrieval PHI scope	Patient-scoped by default.	Cross-record retrieval by default.
Export minimum-necessary	CSV strips PHI, admin override logs.	Full export without scoping.
Consent-aware outreach	Consent object gates communication.	Opt-out list only, no scope.
HIPAA-safe communication templates	Default templates respect minimum necessary.	Generic templates, admin burden.

How teams use Strkr

Five HIPAA deployment playbooks.

The playbooks below are patterns Strkr onboarding sees across HIPAA-covered deployments.

Pattern A

The 14-provider group practice.

A 14-provider group practice in Nashville needed a CRM with a BAA, a referral tracking workflow, and an appointment reminder cadence. The compliance officer countersigned the BAA within three business days with no redline. Strkr onboarding ran a 16-business-day migration. The practice administrator configured role-based access with four distinct roles (front desk, care coordinator, billing, administrator). The HIPAA-safe reminder templates landed on day one and the no-show rate dropped seven percentage points in the first quarter.

Pattern B

The 42-location DME supplier.

A 42-location durable medical equipment supplier needed the BAA for a CRM that handled payer appeals, referral intake, and multi-state operations. The compliance team countersigned the BAA in week one. Strkr onboarding ran a 28-business-day migration with per-state consent template configuration and the audit log retention set to six years. The payer appeal success rate lifted 11 percentage points in year one because the AI-drafted appeals went out same-week instead of lingering in a drafts folder.

Pattern C

The behavioral health telehealth group.

A behavioral health group running 85 percent telehealth needed a BAA plus 42 CFR Part 2 posture for substance use disorder care. The compliance team negotiated the Part 2 clauses at the Scale tier. The deployment ran a 24-business-day migration with the AI retrieval scope tightened for Part 2 records. The AI drafted re-engagement outreach that respected the Part 2 disclosure restrictions, and 11 percent of the lapsed-patient segment re-engaged in the first quarter.

Pattern D

The payer-adjacent care management vendor.

A care management vendor contracted with three regional Medicaid plans needed a HIPAA-compliant CRM that handled member outreach, care gap documentation, and payer reporting. Strkr onboarding ran a 32-business-day migration with per-plan reporting configuration and the audit log retention set to six years. The vendor cleared the payer compliance review in the first quarter and added a fourth plan contract in year two.

Pattern E

The health law firm serving medical practice clients.

A 32-attorney health law practice served medical practice clients, which brought PHI into matter detail. Strkr delivered the BAA on request and the matter object configured with PHI classification. The AI retrieval scope excluded PHI fields from draft generation. The deployment ran a 24-business-day migration and the firm added seven new medical-group clients in the first full year on Strkr.

Run a HIPAA-covered CRM without the Enterprise commit.

Book a 30 minute call. We will walk through the BAA process, the PHI field classification, the AI retrieval scoping, and the audit log posture with your actual compliance requirements.

Start free trial See pricing

Common questions

What buyers in this bucket ask most.

Does Strkr sign a HIPAA Business Associate Agreement?

Yes. Strkr is HIPAA compliant with a BAA available on request. The compliance team sends a standard BAA, and most organizations countersign within three business days with no redline required. The BAA covers subprocessor flow-down, breach notification within 60 days of discovery, use restriction, termination rights, and record retention. The compliance officer can request the SOC 2 Type I report today and the Type II report is in progress with a target of 2026-Q4.

At what tier does Strkr offer the BAA?

The BAA is available on request starting at the Pro tier ($59 per seat per month). The enterprise commit that most CRM vendors require for HIPAA is not necessary on Strkr. For deployments that need additional clauses (42 CFR Part 2, shorter breach notification, EU data residency) the compliance team can negotiate the custom clauses at the Scale tier ($119 per seat per month).

Does the Strkr BAA cover 42 CFR Part 2 for substance use disorder records?

The default Strkr BAA covers the HIPAA posture. 42 CFR Part 2 clauses can be added at the Scale tier for deployments that handle substance use disorder treatment records subject to Part 2. The compliance team negotiates the clause set in the standard BAA addendum, and the deployment configures the AI retrieval scope and the audit log classification to respect the Part 2 disclosure restrictions.

Who is on the Strkr subprocessor list?

The Strkr subprocessor list runs about seven entries and includes AWS as the hosting layer, Clerk for authentication, Stripe for subscription billing, and a short list of operational services. Each subprocessor that touches PHI has a signed BAA. The compliance officer can request the current list on signing and signs up for 30-days notice on additions. The transparency posture matches what mid-market healthcare buyers typically need to clear their internal compliance review.

How does Strkr AI handle PHI without leaking across patient records?

Strkr AI runs with retrieval scope strictly scoped to the active patient record by default. The admin role can enable cross-patient retrieval for a workflow (research cohort analysis, population health) and the cross-patient enablement logs to the audit trail. The AI calls do not train on tenant data, and the audit log captures every AI call with timestamp, patient context, and user. For organizations with heightened PHI concerns the retrieval scope can tighten further to exclude specific field types from any AI call.

What is on the HIPAA roadmap that is not shipped today?

HITRUST certification is on the roadmap and not yet complete. SOC 2 Type II is in progress with a 2026-Q4 target (Type I report is available on request today). FedRAMP authorization is not in the current posture. For deployments that strictly require HITRUST or FedRAMP, the compliance officer should plan around the current posture. The honest timeline on HITRUST is end of 2027 for the certification process to complete at the current engineering pace.

Also built for

Related audiences.

Healthcare Industry Healthcare Provider CRM Healthcare Healthcare Services CRM Medical Practice CRM Secure CRM

Try it free. Bring your team next week.

No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.

Start free trial See pricing