Can You Load Your Patient List Into a Marketing CRM Before the BAA Is Signed?

The question comes up in the first week of every new marketing setup, and people type it into search as "add patient list to crm before baa": can the team load the list now and start building campaigns? The agreement is with legal or waiting on a signature, the contact list is sitting in a spreadsheet, and the pull to get moving is real. The answer is no, and the reason is not a technicality. This post covers why, what to check in the agreement, what to do if the list is already loaded, and a safe order for the import.

Why is a patient list protected health information?

HIPAA defines protected health information as individually identifiable health information that is held or transmitted by a covered entity or its business associate. A list of people who are patients of a practice that is a HIPAA covered entity, such as most dental and medical practices, says something about their health care, and it identifies them. HIPAA's de-identification rule also lists names, telephone numbers and email addresses among the identifiers that must be removed before data stops counting as identifiable. A spreadsheet of names and mobile numbers fails that test.

Practices sometimes assume only chart data counts. A contact list is smaller, but it is the same category, and a vendor that stores it, syncs it or sends messages from it is handling that data on the practice's behalf. HIPAA lets a practice share protected health information with a vendor doing that only when a business associate contract is in place. That is the BAA. Without it, loading the list is likely a disclosure HIPAA does not permit. Your counsel makes that call.

Our primer on HIPAA-compliant marketing covers the general rule of no agreement, no patient data. This post answers the specific CRM import question. The rule that applies to review requests and to ad pixels applies here too.

What to check before the BAA is signed

Signing a form does not make every feature of a CRM safe for patient data. Before anyone signs, ask the vendor, in writing, about each of these.

• Plan tier. Some vendors offer an agreement only on certain plans, or only after a setting is turned on. Confirm that the plan you are buying is one the agreement covers, and ask whether the setting can be undone.
• Covered products. List every product you will use: contacts, workflows, email, text messaging, call recording, forms, scheduling, reporting, AI features and integrations. Ask which are inside the agreement and which are not.
• Import and migration tools. If a third-party tool or an outside person will move the list in, that party touches the data too. It may need its own agreement.
• Where data leaves the system. An export to a spreadsheet, a report emailed to a personal inbox or a file in a shared drive is outside the vendor's controls. Decide who is allowed to export and where files may live.
• Who at the vendor can see data. Ask how support staff access accounts and whether that access is logged.

We do not rate any vendor's compliance in this post, and no vendor name belongs in your decision until the answers are in writing. The agreement text controls, not a sales page or a support chat.

What if the patient list is already in the CRM?

It happens, usually with good intentions. If the list went in before the agreement was signed, treat it as an incident to handle calmly and in order. The steps below are a working checklist. Your counsel decides what the law requires in your situation.

1. Stop everything that runs on the data. Pause workflows, scheduled sends, syncs to other tools and any integration that reads the contacts.
2. Bring in counsel. HIPAA has a breach notification rule, which for covered entities includes a duty to notify affected individuals after a breach of unsecured protected health information. Whether this event meets that definition is a legal decision, not a marketing one, and it should be made with a documented risk assessment.
3. Limit access. Reduce the number of people who can open or export the records while you sort it out.
4. Write down the facts. What was uploaded, which fields, how many records, on what date, by whom, and which products or integrations touched it.
5. Ask the vendor, in writing, to delete the records and to confirm deletion in writing, including copies in backups and logs where that is possible. Ask also whether they will sign an agreement covering the account before any re-upload.
6. Re-import only after the agreement is signed and the plan check is done, using the order below.

Moving fast on the first three steps matters more than finding someone to blame. A written record of a prompt pause helps counsel make the call.

A safe import order

Two things follow the table. Turn sends on only after opt-out handling is checked by the account administrator, and record who may export data, with a review each quarter. Step four also deserves a note. Import only the fields the campaign needs, such as name, mobile number and email. Leave out diagnoses, treatment notes and anything clinical. Marketing rarely needs them, and a smaller file is a smaller problem if something goes wrong.

Where this fits in your practice marketing

A CRM is useful once the foundation is in place. Our guide to choosing a CRM covers what to look for in general, and our medical practice marketing page shows how we build patient acquisition around these rules. Engagements start at $2,500 a month on a six-month term; the three tiers are on our pricing page. Ad spend is separate and belongs to you.

Sources: 45 CFR 160.103, definitions (protected health information) · 45 CFR 164.514, de-identification identifiers · 45 CFR 164.504, business associate contracts · 45 CFR 164.404, notification to individuals