Setting up a CRM for healthcare has specific requirements: HIPAA readiness, Business Associate Agreement (BAA) signature, PHI handling policy, consent capture, and audit logging. Teams searching for Freshsales healthcare setup often need the broader HIPAA-CRM playbook, which applies to any CRM. This page covers the setup steps and shows the Strkr healthcare-ready configuration.
Healthcare teams setting up a CRM typically hit one of six requirements that general-purpose CRM setup overlooks: BAA signature, PHI field tagging, consent capture, audit logging, access controls, and breach-notification workflow. The setup playbook below covers each. Freshsales setup follows the same shape; Strkr's HIPAA-ready configuration applies the same primitives.
HIPAA requires a signed Business Associate Agreement (BAA) with any vendor that handles PHI (Protected Health Information). Without a signed BAA, uploading PHI to the CRM violates HIPAA. Freshsales offers BAA at specific plan tiers; Strkr maintains BAA available on request at the standard tier.
PHI is a category: patient identifiers, dates of care, diagnosis codes, treatment info, insurance info. Not every CRM field needs PHI handling. Tagging specific fields as PHI enables audit logging, encryption, and access control scoped to those fields.
HIPAA plus state medical privacy law require explicit patient consent for marketing communications, data sharing, and specific use cases. Consent capture in the CRM needs: timestamp, source (web form, verbal with recording, written), scope (what was consented to), and retention (how long consent is valid).
HIPAA requires audit logs of PHI access: who viewed what PHI when, who edited what PHI when, who exported what PHI when. Logs retain for 6 years typical. Not every CRM ships full audit depth at the standard tier; verify before deploying PHI.
HIPAA's minimum necessary standard requires role-based access to PHI with need-to-know scoping. The CRM configuration needs: role definitions, PHI-field access by role, record-level access by role (patient assigned to this clinician only), and permission audit for access changes.
HIPAA Breach Notification Rule requires notification within 60 days of discovery of a breach affecting PHI. The CRM configuration needs: breach-detection alerts (unusual access patterns, bulk export, unauthorized role change), incident response workflow, and documentation retention.
Before PHI touches the CRM, the vendor relationship needs HIPAA readiness: BAA signed, security certification (SOC 2 Type II or HITRUST typical), and documented security practices.
Verify the CRM vendor signs BAA at your plan tier. Freshsales offers BAA at specific plan levels; verify with your account rep before committing. Strkr maintains BAA available on request at the standard tier. Signed BAA covers vendor liability for PHI handling.
Verify vendor security certifications: SOC 2 Type II is the common baseline; HITRUST CSF is stronger. Strkr maintains SOC 2 Type II in progress through 2026-Q4. Request the report (SOC 2 Type II) during vendor evaluation; a redacted version shares typical.
Document vendor security practices: encryption at rest (AES-256 or equivalent), encryption in transit (TLS 1.2-plus), backup frequency and retention, incident response procedure, vulnerability management. Vendor security questionnaires (CAIQ, SIG) capture this.
Review vendor subprocessor list for downstream vendors handling PHI (cloud infrastructure, email delivery, SMS carrier, analytics). Each subprocessor needs BAA with the CRM vendor. Request the subprocessor list and confirm each has HIPAA coverage.
Legal counsel reviews the BAA and the MSA (Master Service Agreement) before signature. Red flags: broad liability caps, missing breach notification clauses, missing subprocessor language, missing termination data-return provisions. Legal review is 1-2 week typical for healthcare orgs.
Signed BAA retains for 6 years after the vendor relationship ends. Store BAA in the compliance repository alongside security certifications and subprocessor documentation. Audit trail for the BAA retention is part of ongoing HIPAA compliance.
The CRM data model needs to separate PHI fields from non-PHI fields. PHI fields get enhanced protection: encryption at rest, access control by role, audit logging on view and edit, retention policy.
PHI fields typical for healthcare CRM: patient name, date of birth, address, phone, email (when tied to patient), medical record number, dates of care, diagnosis codes (ICD-10), treatment summary, insurance info, provider assignment. 18 HIPAA-defined identifiers.
Tag each PHI field with an explicit PHI flag in the CRM configuration. The flag triggers: field-level encryption at rest, access logging on view and edit, access control by role, retention policy per field.
Guard against PHI leaking into general notes fields. If notes fields can hold PHI, tag them as PHI. If PHI should not go in notes, add validation (regex check for common PHI patterns) and user training. The leakage problem is common and often invisible.
HIPAA minimum necessary standard: store only PHI the workflow actually needs. If the CRM does not need diagnosis codes to execute workflow, do not store them. Minimizing PHI reduces breach-exposure and audit scope. Review PHI fields quarterly for necessity.
Bulk PHI export (CSV download of 100-plus contacts with PHI) triggers audit log plus optional approval workflow. The audit log captures user, timestamp, scope. Approval workflow routes to compliance officer or manager for sign-off before export.
PHI retention policy: PHI retains per state medical record retention law (typically 6-10 years adult, 25+ years pediatric). Set retention per PHI field category. Automated deletion after retention period reduces breach-exposure for stale PHI.
HIPAA minimum necessary standard requires role-based access with record-level scoping. Each role sees only the PHI the role needs. Each user sees only the records assigned to them.
Define roles with distinct PHI access scope. Clinician sees patient PHI for assigned patients. Nurse sees care-team patient PHI. Admin sees scheduling and contact PHI. Billing sees financial PHI. Compliance sees audit logs. Executive sees anonymized aggregates.
Field-level access by role: billing role cannot see diagnosis fields; admin role cannot see diagnosis fields. Only clinical roles see diagnosis. Field-level access enforces minimum-necessary at the CRM layer rather than through user discipline.
Record-level scoping: clinicians see only patients assigned to them (patient-provider link). Prevents clinician A from browsing clinician B's patients. Breaks the "all users see all records" default that general-purpose CRMs ship.
Emergency PHI access (clinician on call needs to view another provider's patient in emergency): "break-glass" access workflow logs the access reason, user, and record. Compliance reviews break-glass access regularly. Supports emergency care while maintaining audit discipline.
Permission audit logs role assignments and permission changes: who assigned which role to whom, when, and why. Supports HIPAA role-change audit requirements. Compliance team reviews quarterly for role-sprawl and unauthorized access expansion.
User offboarding: terminated users lose PHI access immediately on termination. Automation triggered by HRIS integration (BambooHR, Rippling) deactivates the user and audits the final-session PHI access. Common HIPAA audit finding is delayed offboarding.
HIPAA Audit Logging Rule requires logs of PHI access with 6-year retention. Breach detection workflows surface unusual access patterns before they become reportable breaches.
Access logs capture: user, timestamp, record, field, action (view, edit, export, delete). Logs retain 6 years. Immutable storage prevents tampering. Compliance team reviews logs sampled or filtered on alerts.
Anomaly detection: user accessing far more records than usual, user accessing records outside their normal patient panel, bulk export outside business hours. Alerts route to compliance officer for review. Investigation documented regardless of outcome.
Suspicious access triggers breach assessment: scope (how many patients, which PHI), root cause (user error, malicious, system vulnerability), containment (access revoked, affected data isolated), remediation (user training, system patch). Documented in incident response record.
Confirmed breach triggers HIPAA Breach Notification Rule: 60-day notification to affected individuals, HHS Office for Civil Rights, and media (if 500-plus individuals affected in a state). Notification templates pre-written for speed. Legal counsel reviews before send.
Business associate breach (vendor had a breach affecting your PHI): vendor notifies you per BAA terms; you then notify affected individuals per the same breach notification rule. Review vendor BAA for notification timeline (common: 48 hours from vendor discovery).
Annual internal HIPAA audit: review access logs for pattern anomalies, review role assignments for sprawl, review BAA inventory for completeness, review subprocessor list, review breach-detection alerts and response record. Document findings and remediation.
| Feature | Strkr | Freshsales |
|---|---|---|
| BAA availability | Available on request at standard tier | Available at specific plan tiers |
| SOC 2 Type II | In progress through 2026-Q4 | SOC 2 Type II maintained |
| PHI field tagging | Native tag with enhanced handling | Possible via custom fields |
| Field-level access control | Native role-based field access | Available at higher plan tier |
| Record-level access by assignment | Native via assignment-based visibility | Available via visibility rules |
| Audit log retention | 6-year retention native | Varies by plan tier |
| Break-glass access workflow | Native with reason capture | Workaround via custom automation |
| Pricing | Standard tier | Varies by Freshsales plan |
Start a 14-day Strkr trial with the healthcare configuration template. Request the BAA. Configure PHI field tagging, role-based access, and audit logging. The configuration meets the HIPAA minimum-necessary standard out of the box and scales to clinic, practice, and multi-site healthcare orgs.
HIPAA requires: 1) signed BAA with the CRM vendor, 2) PHI field protection via encryption at rest and in transit, 3) role-based access with minimum-necessary principle, 4) record-level access scoping (clinician sees only assigned patients), 5) audit logging of PHI access with 6-year retention, 6) breach detection and 60-day notification workflow, 7) subprocessor BAA coverage. Each requirement maps to a CRM configuration decision.
Freshsales offers BAA at specific plan tiers. Verify with the Freshsales account rep that your plan includes BAA availability before uploading PHI. Signed BAA covers vendor liability for PHI handling and is required by HIPAA before PHI enters the system. If your current tier does not include BAA, upgrade or switch vendors before storing PHI.
Yes. Strkr maintains BAA available on request at the standard tier for healthcare and other regulated-industry customers. The BAA covers vendor liability for PHI handling, subprocessor coverage (cloud infrastructure, email delivery, SMS carrier), and breach notification. Request BAA at contract signature; standard turnaround is 1-2 weeks.
PHI (Protected Health Information) is any health information that identifies a patient: patient name, date of birth, address, phone, email tied to patient, medical record number, dates of care, diagnosis codes, treatment summary, insurance info. HIPAA defines 18 identifiers. PHI protection in the CRM: tag PHI fields with explicit PHI flag, enable field-level encryption at rest, enable access logging on view and edit, enforce role-based access control, document retention policy per field.
Set up access controls in 4 steps: 1) define healthcare roles (clinician, nurse, admin, billing, compliance, exec) with distinct PHI scope per role, 2) enforce field-level access (billing cannot see diagnosis codes, admin cannot see diagnosis codes, only clinical roles see diagnosis), 3) enforce record-level scoping (clinician sees only assigned patients via patient-provider link), 4) configure break-glass access workflow for emergency access with reason logging. Permission audit quarterly prevents role sprawl.
A HIPAA breach is unauthorized access, use, or disclosure of PHI that compromises its security or privacy. On breach discovery: 1) contain the breach (revoke access, isolate affected data), 2) assess scope (how many patients, which PHI, root cause), 3) document in incident response record, 4) notify affected individuals within 60 days, 5) notify HHS Office for Civil Rights within 60 days (annually for small breaches, immediately for 500-plus), 6) notify media if 500-plus individuals affected in a state. Vendor breaches follow the same workflow with notification from the vendor to the covered entity per BAA terms.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
